Add UTF8 locks; check Verify response status; limit returned devices

I have minor concerns that this could panic if status:failure and there's no reason provided. I think that if this happens, FxA is broken since failures should always return status.
That said, I'm happy to be paranoid and add checks.