validate custom data to prevent submission errors

http://manage.dimagi.com/default.asp?142187
Oh, actually that doesn't validate "xml" as a prefix.  Maybe we should add explicit xml var name validation. @twymer