Make DropScope#except accept an array of records.
Escape output of request.params to get rid of XSS.