I've been using the same set of allowed_param in the hack I put together (which is working well, at least with my app) except I left out "show_user" : have you tried to see if it actually does anything? I couldn't see it mentioned in the api docs - perhaps it's ignored and perhaps at a later date it'll generate an error??