implement query parameters filtering, can prevent mass-assignment, closes #905

See the discussion at #905