Added input firewall.

Pretty mechanical.  Things to check:
  * Are the regex's good?  We match for userId and clientId.
  * Is there a reflection system for Typescript?  The schema validation seemed especially mechanical.
I believe userids don't need to be user@domain formatted, and that other social providers currently use either an internal alpha-numeric ID (e.g. facebook) or a string with spaces (the web socket public social provider assigns you a user id like "John Smith")