protecting agains possible xss if controller is called directly and a type param is specified