no params for json GET; notate an injection bug...