Require the use of the master key for some operations (RIPD-666)

* The first two commits include only changes in functionality: requiring the use of the master key when disabling the use of the master key and when enabling `NoFreeze` respectively. 
* The third commit fixes the message key handling, which results in an empty `sfMessageKey` field being present in the account root when trying to remove the field.
* The last commit contains cleanups and a bit of extra commenting. In a number of places, we check that the flag we're setting can't be the same as the flag we're clearing, but we check that invariant early on.

Reviews: @JoelKatz, @scottschurr