Add server-side validations

* Validate `Spot#images` instead of `Spot#image_ids`

Error messages make more sense when in the context of the relations, not the
ids
Accept `spot[:image_ids] = []` by allowing `nil`