General fixes to make user-api work with blip

In integrating blip, I noticed two things:

1) Setting up CORS headers for the username and password headers was annoying.  Talked with Kent and he agreed that switching to HTTP basic auth made sense.

2) The error handling was a little wonky, so, I added some logic to handle the one case I ran into.

@kentquirk @jh-bate If you get a chance to look at this as well, I'd appreciate it.  It's much smaller than the styx changes, so if you pick one, check out this one.