Fix a security problem.

Now Form::validate no longer changes its behavior based on user
submitted data, but rather developer supplied data. Fixes a potential
security problem.