I simplified things a good bit in the logic here, and I think it will come even cleaner when we rename "Account Request" to "Sign Up".

Basically, if you can't create "Sign Up" or "User" cards, you can't sign up.
If you can create Sign Up cards but not User cards, you can sign up but will require approval (this functionality is not yet restored)
If you can create both, you can sign up without approval (still requires email verification).

The old rules were much more confusing (I could never remember them, personally), and involved a bunch of permissioning of the +*account card.   I think it's now much cleaner, since folks don't think about that at all.