Check objects for API calls

[sebgie]

Refs #2187 & #2697

We currently do not check the object of an API call for allowed or required properties before processing it. If the check fails there are two possible error states this could lead to:

• BadRequestError (400): JSON structure is malformed and therefore could not be understood (missing root key, empty body, ...). This is related to Introduce utility functions to ease API handling #2697.

Example (structure wrong):
PUT /ghost/api/v0.1/posts/1

{
    id: 1,
    post: [{...}]
}

• ValidationError (422): JSON structure is valid but a property is missing/not allowed. This will probably require to define a list of required and optional properties. Maybe it is a good idea to derive/include this list from/in schema.js and use it with our validation?

Example (my-markdown not allowed):
PUT /ghost/api/v0.1/posts/1

{
    posts:[{
        id: 1,
        my-markdown: '...',
        ...
    }] 
}

[ErisDS]

I'm closing most API issues temporarily with the later label.

JSON API Overhaul & OAuth access are currently scheduled next on the roadmap