Added input firewall.

Pretty mechanical.  Things to check:
  * Are the regex's good?  We match for userId and clientId.
  * Is there a reflection system for Typescript?  The schema validation seemed especially mechanical.
can this be console.warn instead, so it is more obvious in the logs?