strip restricted fields from GET reqs