Correct typo
Expose unpermitted param keys in CleanedParams

This allows us to introspect the parameters that we are rejecting.
Notify on unpermitted params in document filters

This allows us to keep an eye on requests with unpermitted params
without 500-ing at the user. Once we are satisfied that we are not
incorrectly rejecting legitimate parameters in document filter
requests, we can revert this commit to reduce exception noise due to
script kidies sending strange requests.