body, params, and query disallow unknown items

I don't think that validation should pass if the body contains parameters not specified in the joi schema.  This change disallows extra parameters in body, query, and params.  It makes more sense to allow extra header parameters, so I left those in.