auth: force webhooks to read-only
valid: accept format strings
valid: Fix Sprintf call
valid: new module for input validation