adding `err` to `validate` signature, removing global

I keep wanting to distinguish between application errors and validation
errors, e.g. if something goes wrong with our db connection, I'd like
to return a 500 rather than a 400. It'll also generally fit better with
node, and be nice for doing stuff like this:

```
batch.push(function (done) { validator.validate(done); });
```

The downside is that we have to change the signature for any existing
async calls.

Also removed global each