validate resource keys at compile time

 - since Liberator has an extensive set of possible keys, it is good to
   validate that keys are valid options to avoid confusing bugs when you
   mistype some keys.
 - because the first key could always be something that evaluates to a
   map of keys, I don't validate the first if it looks like a shared
   options map.
 - we _could_ eval the first thing in those cases and then check its
   keys but I think that would be too surprising and weird to do that,
   because people generally don't want their code evaluated at compile
   time without it being obvious