Fix issues with Validation::inList() and SecurityComponent

Fix a few issues with `Validation::inList()` being a little too forgiving, and SecurityComponent being too helpful with deeply nested POST data sets.