Properly validate ALLOWED_FILTERS.

- If the data layer supports a list of allowed operators, take them
into consideration when validating the query string.

- Recursively validate the whole query string. Previously, only the
first layer was being validated.

Closes #388.