allow blacklisted attributes, make json the default response type, cleaned up variable/method names