Support a whitelist in DomainObject::load() to prevent injection attacks

 ```php
<?php

// ensure we only update timeupdated and timelastseen
$user = User::byId($userid)->load($_GET, array('timeupdated', 'timelastseen'))->save();
```