Gracefully handle extra fields in the input

Return a 422 witherror details instead of blowing up.