[REDACTED] object parsing silently strips unknown keys, defeating reject-on-forbidden-field security guards