Enforce correct MD5 when provided by a client

Matches behavior of real blobstores.