Update CHANGELOG
Do not do case insensitive ops in parameter filtering

String.downcase/1 is not a fast operation as it always needs to
traverse the whole string. Furthermore, the casing of the parameter
matters in controllers and in code, meaning that sending "Password"
where "password" is expected won't work, so we don't need to worry
about filtering invalid data (or data sent in the wrong format).