1. The param should be `url` I think.
2. You shouldn't have to validate this. Source should be responsible for making sure that a url is given. If the url is invalid, it will result in a Facebook or HTTP error which is handled below.