404 on DELETE member w/ invalid ID

The fact that we validate the member ID as a hex-encoded uint64 is an optimization in the server. Failing this check does not warrant a different user-facing error code than if that ID was valid but does not represent an existing member.

Rebased on #1492
If we're going to elevate the type requirement to the spec, then we can can close this PR. Conceptually, it comes down to when you validate the request vs when you validate the request path. I really don't like doing them both all at the same time - I would rather always validate the request path before the headers/body.