Specifically throw a 403 rather than a 401 when the terms of use have not been accepted.
Missed a few lines in the cherry pick...
Fix for registering user changing password
+ test
Fix for bad error throwing when checking password of user that doesn't exist
Merge pull request #763 from kaysoky/ToUException

Throw 403 for ToU exceptions