Document validation mechanisms

in #270 (closed) I added some ad-hoc instructions over how we do validation. We use spring serverside validation with docs here and should prefer the browser constraint api with docs here.

These should be covered in our Contributing.md