Adds user accounts to the mock server and requires request auth.
Implements user accounts and apitoken support.

Also cleans up some response status codes to return 404 where an expected
403 was asserted.