validate client-provided names

Plus some fixes to be sure everyone sees errors