So actually, there are a couple of issues here:

1. If I am going to implement this as a whitelist of legal / required query parameters, is that something we really want to do retroactively against the v1/v2 endpoints?  I kind of feel like that would be heavy-handed.  It would totally make sense to do it on the v3 endpoints, but it's a behavior change for v1/v2.  (I realize that I'm already introducing a behavior change by explicilty forbidding the paging params on v1/v2, but I feel like that's more acceptable since it is really there to give the users a better error message if they're trying to page...)
2. If I'm not going to retroactively do this for v1/v2 then I still need a blacklist-based middleware function rather than a whitelist one.
3. I really don't want to have to spread the knowledge about what the list of paging parameters is around to every single endpoint that supports them, so there is still going to need to be *some* paging-specific function that encapsulates them.