Sanitize/munge request POST data

Disallow direct "script" keys but allow named scripts.
Test new QuerySanitizer