validate ZAP messages

adds checks that ZAP messages are actually valid

Bugs in zeromq (e.g. zeromq/libzmq#948) can result in invalid messages.
These shouldn't result in exceptions in the auth handler.