Add spec for handling invalid post data, and update controller per the spec

I got some 500 errors from bots posting invalid data so params[:lockup] was nil. This should fix it.