removed JS escaped chars too early, also allowed empty params to be payloaded