Validate HTTP API user input

For example, raft indices must be sane integers.
when will this happen? seems like we need to panic here, at least log the unexpected action here.