Add check for special url characters to createPad API function

This will add a check to forbid special url characters (like /, ?, & and #) on the createPad API function.
This is only a small improvement, because it doesn't fix the whole bug reported in #2287
Characters like ':' are sanitized by the function padManager.sanitizePadId in APIHandler.js line 414. We should move this function inside the createPad method so we could give back an error if the sanitizedPadId is not equal with the original padId. Is there any reason why every API call with a padId uses this function?