Validate public_id values in URL paths.

We should consider changing the HasPublicID mixin design so that comparisons to
an invalid public id return no results, instead of raising StatementError. But
in the interim, just validate these URL fragments at the API level.