add restriction on extension creation/update in REST API
Merge branch 'extension_validation'