BaseController: exclude internal attributes from resource_params by default