don't hardcode accepted hash algorithms in regexp.
put valid hash algs in VALID_HASHES and validate against them.
Validate interdependent fields in badges.

Implementation isn't very optimal because it was harder to modify
existing tests than it was to simply tack behavior onto more
high-level functions that aren't tested as rigorously.