For now, simply assume the passed name is legit.

We need to come up with some kind of cached whitelist of all the function, hook, class, and method slugs. The original thought was to verify the URLs via a remote request but I can see that becoming a problem pretty quickly. Obviously, we don't want to hit the database to verify either.