getLastErrors is not thread safe

[kevinburke]

If I am sharing a validator instance across multiple Node workers running on different CPU processes, getLastErrors is not a safe API. Consider the following sequence of events:

• Thread 1 calls validator.validate and stores a value on lastReport
• Thread 2 calls validator.validate and stores a value on lastReport
• Thread 1 calls getLastErrors and retrieves the error from Thread 2.

This may expose private data from the request in Thread 2 to Thread 1, so this is also a security risk.

In my experience running Node with e.g. cluster, https://nodejs.org/api/cluster.html, or https://github.com/hunterloftis/throng is pretty common, and it wouldn't be too odd to see a single validator shared by each of these threads.

A better API may be to have validate throw the value currently being stored in lastReport (if any) so the user performing the validation can catch it.