Bug 1080242 - locked account

@rnewman: over to you for a preliminary review.  This isn't final, because:

* the error code isn't determined
* the `unlock/resend_code` endpoint hasn't been speced;
* copy isn't agreed to.

But the ideas are in place.