but then the middleware or js could just strip out it's extra params. Though that invites it's own problems - e.g. if the application actually used the `s` par

but then the middleware or js could just strip out it's extra params. Though that invites it's own problems - e.g. if the application actually used the `s` param, and something came along and started using it too... but this case is in general a world of hurt. I'm not really sure why we'd want a world where the server doesn't know about all query args, but seems like we're already stuck with this.