Custom entrypoints: more checks, allow query vars