fix vulnerability and whitespace

you could send arbitrary data in as the mixId and it would be
entered into the database.

fix: check to make sure the mix id is associated with a playlist
before adding it to the database