Account lockout

This is a work-in-progress branch for implementing account lockout, as described in #801.  The first commit is a concrete API spec, for discussion.

Things of note:

* The `resend_code` endpoint has the usual oauth continuation mumbo-jumbo, in keeping with other email-sending endpoints.
* The `verify_code` takes both `uid` and `code`, in the same way that `recovery_email/verify_code` does.  I'm not sure this is a good idea since we will have to make sure the verification page as the `uid` available.  But it's unauthenticated so it can't take the `uid` from its authenticated context like `password/forgot/verify_code`.

@dannycoates @zaach @ncalexan f?
> do not know where request.app.acceptLanguage is set.

This is the canonicalized repr of the `accept-language` header, set in `server/server.js`.

> the lang option sent to /account/create

I don't think we accept such an option explicitly, but we *do* store the value of `accept-language` that was used to create the account.

So in this PR the mail uses the `Accept-Language` header of the current request, which is also what the forgot-password email uses.

I don't recall whether we're supposed to prefer the current value, or the value from account creation time.  But we should definitely use one as a fallback in the event the other is missing.