Brought up in canjs/canjs-feathers#2 for REST calls the user can only directly modify params.query. Maybe, in order to be consistent, SocketIO and Primus calls should do the same thing and map params from the client into params.query instead of passing them directly. That way it would be consistent and other params properties can only be set on the server.