Make passcode redemption error messages much more descriptive

Make passcode redemption error messages much more descriptive.

The passcode redemption API rate-limits clients. Let the client know when this has happened, or if another HTTP error has happened instead.

Swap around the display of resonators and XMPs, since XMPs seem like they're usually harder to get than resonators.