Validation in controllers

@John_Betong: That's a HUGE security problem. As people can just delete those from the DOM and submit XSS etc without any issue.

Personally I'm using form validation inside Controllers (with private functions to load my rules), as I'm using multiple models for saving data. So I need to validate it before processing it into my models. If I would do it again from scratch I would put my logic inside a library or extend a controller with those private functions. So that the main controller won't be so bloated.