More input/type validation in the main user content plugins, cleanup

Found this stuff while working on #4525 issues. I still need to test all the pages/actions these commits touch.