Make it clear that extra keys in the request/response payloads are not allowed

[benjie]

This is a task for myself really.

The extensions object exists so that vendors may add their own properties to requests/responses/errors/etc. All top-level keys are reserved by the spec. We should make this explicit, such that adding id as a key to a request automatically makes the request not a GraphQL-over-HTTP request. (Which is fine, because the server is still allowed to handle it however it sees fit.)

[benjie]

(This relates to @martinbonnin's comments here: #264 (comment))

[benjie]

Closing in favour of #278