New validator

This still needs some comments and tests but the basic structure is there. Tear it up.
Should we validate the userdata on every run or only those with `--validate`? I'm leaning toward running only when the flag is given.