fixing potential malicious use of params
refactoring csv downloads to allow params