add RequestStore gem, support universal only param for api endpoints (fixes #4068)

app/controllers/application_controller.rb

@@ -10,6 +10,7 @@ class ApplicationController < ActionController::Base
   before_action :api_check
   before_action :set_safe_mode
   before_action :set_variant
+  before_action :track_only_param
   # before_action :secure_cookies_check
   layout "default"
   helper_method :show_moderation_notice?
@@ -48,6 +49,12 @@ class ApplicationController < ActionController::Base
     end
   end
 
+  def track_only_param
+    if params[:only]
+      RequestStore[:only_param] = params[:only].split(/,/)
+    end
+  end
+
   def api_check
     if !CurrentUser.is_anonymous? && !request.get? && !request.head?
       if CurrentUser.user.token_bucket.nil?