Api security

[joshwanf]

Resolves #250 by adding validation/serialization to the relevant endpoints. Invalid requests return a standardized ApiError with a message. For the case where someone creates a Screener while supplying a publishedScreenerId field, the API responds with:

{
  error: true;
  message: "Unknown field 'publishedScreenerId'";
}

ApiError can be used elsewhere to return a response instead of throwing.