parse json on the fly instead of a separate task
rename forbidden keys
always set failure messages for options
simplify determination of missing and forbidden keys