Fail payment validation for disabled payment methods

Payment::availablePaymentMethods() only validates payments against enabled payment methods, but this check should be in PaymentMethodController::validate(), which is where it belongs conceptually and because it's more foolproof.