Generating an anti-bot secret automatically
because there's no reason not to
Added signup-specific middleware, fixed signup bug
where a 400 would generate rather than a friendly validation error