When the REST API spec was first written we assumed additionalProperties: false was the default behavior. It probably was by then.
We recently found the need to explicitly add it to all the relevant places (i.e. those that require strictness).
This bug adds it, and fixes the tests that fail or the error conditions that were hidden due to this being absent in the spec.