Check levels are valid, and auto-populate from request