/api/ routes now use json_response helper

Some JSON responses (mostly error-related ones) had bodies containing
badly-formatted string literals. The newly-added json_response helper
makes it easier to create JSON responses in /api/ routes.
Improved Models::User validation and testing