Sanitize dynamic parameters

[eric-burel]

We should block requests with absurd "lang" dynamic parameter (= first param of the URL in surveyform), typically people trying to shove SQL injections into route parameters The lang param seems to end up being used as a Redis key even if not valid

[SachaG]

I think we can use an allow-list, since we know in advance every valid value for that parameter?

[eric-burel]

I've double checked and it's ok for the state of js, if your lang doesn't exist it will use the default one