Implements user accounts and apitoken support.

Also cleans up some response status codes to return 404 where an expected
403 was asserted.