valid: add generic optional interface

auth: force webhooks to read-only

valid: accept format strings

valid: Fix Sprintf call

valid: new module for input validation