Switch all of the uses of req.param here to req.query so parameters can only come from one place