Make Validator its own class, because it's going to want state soon.
Return HTTP 400 rather than 200 on error.
Barf on unknown schemas (without a way to make them known, currently).
Add http:/example.com as an allow-all JSON schema.
Configure Validator with our schema (don't do the validation yet).
We don't actually want to return the original JSON.
Validate against draft Commodity schema.