Content views: locking down params in api controllers
Merge pull request #1386 from daviddavis/param_rules

Content views: locking down params in api controllers