Security Fix: Do not allow arbitrary task types from params to be constantized directly

# Description
Do not allow user to pass in whatever they want from the front end to be constantized and used within the app.

# References
* https://www.pivotaltracker.com/story/show/80334890

# Notes
* We really need an authoritative source for what are valid/allowed task types.  We essentially have that in our `TaskType` factory except for one lone holdout, the good 'ol `MessageTask`.  I decided to add it with these changes so that we can allow it to be verified before creation.