diff --git a/lib/cartodb/api/auth_api.js b/lib/cartodb/api/auth_api.js
index 5b62ff44..709667f8 100644
--- a/lib/cartodb/api/auth_api.js
+++ b/lib/cartodb/api/auth_api.js
@@ -86,7 +86,7 @@ AuthApi.prototype.authorizedByAPIKey = function(user, req, callback) {
  * @param req - standard req object. Importantly contains table and host information
  * @param callback function(err, allowed) is access allowed not?
  */
-AuthApi.prototype.authorize = function(req, res, callback) {
+AuthApi.prototype.authorize = function(req, params, callback) {
     var self = this;
     var user = req.context.user;
 
@@ -101,11 +101,11 @@ AuthApi.prototype.authorize = function(req, res, callback) {
             // if not authorized by api_key, continue
             if (!authorized)  {
                 // not authorized by api_key, check if authorized by signer
-                return self.authorizedBySigner(res.locals, this);
+                return self.authorizedBySigner(params, this);
             }
 
             // authorized by api key, login as the given username and stop
-            self.pgConnection.setDBAuth(user, res.locals, function(err) {
+            self.pgConnection.setDBAuth(user, params, function(err) {
                 callback(err, true); // authorized (or error)
             });
         },
@@ -120,7 +120,7 @@ AuthApi.prototype.authorize = function(req, res, callback) {
                 // if no signer name was given, let dbparams and
                 // PostgreSQL do the rest.
                 //
-                if ( ! res.locals.signer ) {
+                if ( ! params.signer ) {
                     return callback(null, true); // authorized so far
                 }
 
@@ -128,7 +128,7 @@ AuthApi.prototype.authorize = function(req, res, callback) {
                 return callback(null, false);
             }
 
-            self.pgConnection.setDBAuth(user, res.locals, function(err) {
+            self.pgConnection.setDBAuth(user, params, function(err) {
                 req.profiler.done('setDBAuth');
                 callback(err, true); // authorized (or error)
             });
diff --git a/lib/cartodb/controllers/named_maps.js b/lib/cartodb/controllers/named_maps.js
index 3f1c3437..5748cba7 100644
--- a/lib/cartodb/controllers/named_maps.js
+++ b/lib/cartodb/controllers/named_maps.js
@@ -144,7 +144,7 @@ NamedMapsController.prototype.staticMap = function(req, res, next) {
 
             namedMapProvider = _namedMapProvider;
  
-            self.prepareLayerFilterFromPreviewLayers(cdbUser, req, res, namedMapProvider, this);
+            self.prepareLayerFilterFromPreviewLayers(cdbUser, req, res.locals, namedMapProvider, this);
         },
         function prepareImageOptions(err) {
             assert.ifError(err);
@@ -194,7 +194,7 @@ NamedMapsController.prototype.staticMap = function(req, res, next) {
 NamedMapsController.prototype.prepareLayerFilterFromPreviewLayers = function (
     user, 
     req, 
-    res, 
+    params, 
     namedMapProvider, 
     callback
 ) {
@@ -222,7 +222,7 @@ NamedMapsController.prototype.prepareLayerFilterFromPreviewLayers = function (
         }
 
         // overwrites 'all' default filter
-        res.locals.layer = layerVisibilityFilter.join(',');
+        params.layer = layerVisibilityFilter.join(',');
 
         // recreates the provider
         self.namedMapProviderCache.get(
@@ -230,7 +230,7 @@ NamedMapsController.prototype.prepareLayerFilterFromPreviewLayers = function (
             req.params.template_id,
             req.query.config,
             req.query.auth_token,
-            res.locals,
+            params,
             callback
         );
     });
diff --git a/lib/cartodb/middleware/context/authorize.js b/lib/cartodb/middleware/context/authorize.js
index a42b5407..dd29f502 100644
--- a/lib/cartodb/middleware/context/authorize.js
+++ b/lib/cartodb/middleware/context/authorize.js
@@ -2,7 +2,7 @@ module.exports = function authorizeMiddleware (authApi) {
     return function (req, res, next) {
         req.profiler.done('req2params.setup');
 
-        authApi.authorize(req, res, (err, authorized) => {
+        authApi.authorize(req, res.locals, (err, authorized) => {
             req.profiler.done('authorize');
             if (err) {
                 return next(err);