Missing sanitization and/or validation for `sortByField`, `sortByOrder`, `page`. It's true they aren't sent to the page for rendering, but we should probably start getting into good habits now