ciao-controller should use checked type assertions

[markdryan]

There are a number of places in api/api.go where ciao-controller is used non-checked type assertions to convert data received from a client into some other type, usually a map[string]interface{}.

There's no guarantee that this conversion will work, if for example the client sends a json document containing a single int. In this case ciao-controller will panic.

[markdryan]

Here's an example:

https://github.com/ciao-project/ciao/blob/master/ciao-controller/api/api.go#L1053