I believe all parametres posted using GET can be predictable. So you can `request_var()` them, so that it is secured.