Add checks around `marshal.load`

[mhucka]

This is an attempt to address code scanning alert #567 about unsafe deserialization of user-provided data. This adds some checking around the unmarshaling of stored operators.