upload-pack: tighten request validation.