Add form validation for length of state

[vsoch]

A lot of people are tempted to put abbreviations for the state, so we can get around this with a little form validation that prevents two letters.