404 on DELETE member w/ invalid ID

The fact that we validate the member ID as a hex-encoded uint64 is an optimization in the server. Failing this check does not warrant a different user-facing error code than if that ID was valid but does not represent an existing member.

Rebased on #1492
I'm for elevating it into the spec; we enforce types this way elsewhere (e.g. for integer fields in other requests)