Factor out validation logic.
Add safe extend function.

`safeExtend` takes a target and a source and only copies fields from the
source that exist in the target.
Send better validation error response.
Better validation error for PUT as well.
Don't allow updating with garbage fields.

Use `safeExtend` to ensure the fields that are submitted actually exist
in the badge so we don't get a database error when we try to update.
Remove `name` from errors.

Reduces a lot of redundancy.
Use `makeValidator` helper in the image model.
Update tests.