Add action validation (on server and client).

Message validation is handled in validate-action, making it easy to
share the same validation code server-side and client-side.