Validate HTTP API user input

For example, raft indices must be sane integers.
This function might actually be cleaned up a lot if you name the return variables and just use those instead of returning `emptyReq` all over the place.