Raise ValidationException on invalid ObjectId from user input

Before we did not catch the exception, resulting in a 500.