This fixes a number of subtle bugs and restricts "sloppy"
argument coercion (e.g. 'true' to the bool true) to string-only
HTTP datasources like querystrings and headers.

Fixes strongloop#223 (coerced Number past MAX_SAFE_INTEGER)
Possible fix for strongloop#208

This puts the bulk of the coercion into the http handlers,
assuming that otherwise coercion is not desired in favor
of strictness.

Coercion now runs on qs/header/formdata regardless of 'any'
type, and barely runs at all on JSON or direct invocation.