Add a whitelist to the last commit so that parsing of API vars is limited to just: page, user, session, for now. We'll add more later or make it configurable.