[api] make sure we throw the right error for invalid users
[api] also accept verifymd5 for lastsuccess calls