This fixes a release-blocking issue where we weren't running client-side validation until _two_ characters were entered, and we were missing pasted text.
Thanks to bmclaughlin and jrist for assistance with debugging the JavaScript on this one!
-- Matt