Request: only allow data in one source for getVar
Request: only allow data in one source for getVar

When data for a given index is present in both $var and $_REQUEST,
there is a question about which source we should prefer:

* If we prefer $_REQUEST, then that is vulnerable to abuse if the
  player forges request data when $var is expected.

* If we prefer $var, then player input might be ignored if there is
  spurious data in the container.

However, we can circumvent this decision if we only allow the data to
be present in one or the other when we query it. This strictness will
help to ensure that request data comes from a legitimate source, and
will also help to identify errors in container forwarding (e.g. if we
put the wrong data in a container).

hemberger/smr,smrealms/smr,smrealms/smr,smrealms/smr,hemberger/smr,hemberger/smr,hemberger/smr