Add test that secret length is enforced
Added explicit check for attribute name validity

Relying on #send to fail opens up any method ending in '=' to the user.
More robust to force everything through a whitelist.
Move identifier generation into model class
Use model class for admin edits as well