The difficulty with this is that we don't know allowed geos for any (non-covidcast) endpoints. The server side doesn't check geo validity either. We should figure out included geos as part of endpoint documentation upgrades, which will let us explicitly list allowed geos for each endpoint and check user input against that.