On server stuff I've been leaning toward doing more validation up front, but since this is designed to be used on Android I'm ok with skipping the object creation and validation.  It should be pretty obvious if you try to build a thumbor url with a garbage url.