first go at documentation patch for known param exploit
tweak the docs and announce depracation
make the httpexception filter more choosey
remove mistaken file
make the env in Engine weak so that its request scoped
merged from master