use params.all() for logging of params - this is more safe in case of POST