strip restricted fields for GET reqs