Sanitize even if no % is preesnt
Instead of sanitizing, raise 400 error if any param is invalid
Skip cookie check