Added input firewall.

Pretty mechanical.  Things to check:
  * Are the regex's good?  We match for userId and clientId.
  * Is there a reflection system for Typescript?  The schema validation seemed especially mechanical.
can you make function names start with lowercase, like isValidUserProfile?