CC-5733: RESTful API data sanitization and validation

small fix - was setting the hidden flag twice