CLC-4229-1 - /act_as endpoint should only allow uid's that are valid

https://jira.ets.berkeley.edu/jira/browse/CLC-4229
@edwlook interesting that we didn't need it before with the other 2 methods in there.