How to verify a request parser drops non-whitelisted execution fields?