update validator to 2.1.0

Because of http://nodesecurity.io/advisories/validator_XSS_Filter_Bypass_via_Encoded_URL

The 3.x versions is not backwards compatible, and requires a bit of refactoring to work with.