implement query parameters filtering, can prevent mass-assignment, closes #905