Bug 1080242 - locked account

@rnewman: over to you for a preliminary review.  This isn't final, because:

* the error code isn't determined
* the `unlock/resend_code` endpoint hasn't been speced;
* copy isn't agreed to.

But the ideas are in place.
My read of https://github.com/mozilla/fxa-auth-server/issues/801#issuecomment-56592929 is that this should be `account/unlock/resend_code`.