Sanitize $nodeSourceID in browse

While they were escaped and it doesn’t appear SQL injection is possible
through this vector, the behavior was still odd.

This change validates the input and ignores if it is invalid.

Fixes #33