Filter URLs that aren't strings
Validate ID on input
Validate that the type of an activity object is a string
It's OK to have no ID
Merge remote-tracking branch 'upstream/master' into pump.jpope.org