Add validation when processing pod manifests from a URL.

I think this should use api.Decode now.