Added validation for request headers.

At least partially addresses #1588.

When will `object.unknown()` from joi land in hapi?  Once it does, it should be applied to header validation due to all the extraneous headers sent with most requests.  Or is there a better way to do it today?