Handle `QueryParam` with key "`c`"

[stefan-niedermann]

Issue

Given one adds a QueryParam with the key c, the backend will respond with HTTP 400 as this parameter is reserved for CSRF protection.

Options

Don't handle at all

This leads to a HTTP 400 response with a stacktrace that is quite hard to understand (status quo)

Log warning

If the user actually knows what he does and wants to add this parameter, we don't block him but still are visible in case he wonders why something fails.

Throw meaningful Exception

One could assume that it is simply wrong to add this parameter and throw a meaningful Exception. This is a breaking change and can be a potential issue in case the user really wants to do this for some reason.

---

Looking forward for opinions :slightly_smiling_face: PS.: This issue has been split out of #266

[tobiasKaminsky]

Is this not also a problem for a regular http call directly to server, without SSO?

[stefan-niedermann]

Yes, it is.

[tobiasKaminsky]

Then we, as in SSO, do not need to deal with it, right?

[stefan-niedermann]

Right.