better input sanitization: only allow the defined params (and a small set of globally available ones) into the action