refs APP-INPUTVAL

Nice to have.

To prevent insecure property access where a post body like {"name":{"toString":"OVERWRITE"}} handled by code like:

var o = {};
try {
   o = JSON.parse(req.body)
} catch (error) {
   // silently
}
o.name + ' ok'

triggers an error.

It'd be good to validate the incoming objects before parsing (e.g. with joi and celebrate.

https://github.com/mozilla-services/pageshot/blob/master/server/src/server.js#L593-L603 is great because it resets the object or throws from the catch block preventing the insecure property access, but we could fail earlier and provide more detailed error messages by validating the object in advance.