Share dataset

passing whatever arbitrary `params` the user posted is dangerous, let's pull out the username and role then pass those to the API.