Unauthorized attempts on API calls return 403.  Login can be either username or email. Improved form validation on registration (WIP).