Account lockout

This is a work-in-progress branch for implementing account lockout, as described in #801.  The first commit is a concrete API spec, for discussion.

Things of note:

* The `resend_code` endpoint has the usual oauth continuation mumbo-jumbo, in keeping with other email-sending endpoints.
* The `verify_code` takes both `uid` and `code`, in the same way that `recovery_email/verify_code` does.  I'm not sure this is a good idea since we will have to make sure the verification page as the `uid` available.  But it's unauthenticated so it can't take the `uid` from its authenticated context like `password/forgot/verify_code`.

@dannycoates @zaach @ncalexan f?
> The best suggestion I have at the moment is to expose a lock_account endpoint in dev for testing purposes, but disable it in production.

Probably need it in stage too, but then we have the problem of never testing the actual code we're shipping. 

An alternative is support an undocumented param to each endpoint that makes the endpoint treat the account as being locked without actually locking the account. The tradeoff there is that the backend code may be messier to maintain.