[1.4.x] Prevented data leakage in contrib.admin via query string manipulation.

      This is a security fix. Disclosure following shortly.