Fix lock/unlock/make_default.

Require POST, not GET.

Also make_default returns 404, not 403 if person doesn't have this
account.

Change-Id: Ia666efcdb7ede0b00d933f22b84e2a6a22638779