As Rails doesn't give a clear way to get only body parameters so I'm not sure if we really have to do complex things to protect developer who don't understand security problems.