restricted json, not just json-encoded php objects
decode before we encode, for fun!