add some client side validation to make sure org/course/run is URL sage