Add validation so that extraneous parameters can come through in the
request

The app doesn't do anything with them, but Hapi requires explicit
validation.

We should stop using Hapi.