Content views: locking down params in api controllers