Also sanitize 'source' querystring param

since that can be passed to ES like the request body