Non-hash resource param throws exception

Saw some kind of malicious user/bot posting invalid params, which was triggering 5xx errors.

Instead, I think it should be returning kind of 4xx error without an exception, since it's bad data coming from a user.

Haven't patched it yet, but here's a start - a failing test case.