allow all property in req.query pass middleware