Validate ObjectId fields in routes.