enforce that no extensions are used in the params groked from the URL