Added input firewall.

Pretty mechanical.  Things to check:
  * Are the regex's good?  We match for userId and clientId.
  * Is there a reflection system for Typescript?  The schema validation seemed especially mechanical.
should these also call fail()?