Fix Host validations

- make our existing validations work, and test them
- also validate that a non-aka host can't have a canonical_host_id (which would imply that it is the aka of that host)