moved some graph traversal validation into the traversal module

- that simplifies some of the traversal-calling routines
- make returning error codes more consistent (specific 404 errors when
referring to unknown collections instead of simple 400 errors)
- optionally limit traversals to a certain number of iterations so they
  don't run endlessly in cyclic graphs