strip restricted fields for post/put