Account API revisions and more sensible HTTP responses

Allow the account API to accept an email string directly; return code 400 instead of 500 when the user is not valid; make rate-limiting test more general