document user registration API, tighten up pseudonym validation

refs CNVS-10001

document existing behavior around how this api can be used by non-admins
for user registration (if self-registration is turned on for the account).

only functional change is to really require email pseudonyms if you're a
non-admin doing an API request. it was already required for non-admins
doing non-API requests (since @context and @domain_root_account would be
the same ruby object)

test plan:
specs

Change-Id: I165872e9d7133521b799d410299e235f19408f59
Reviewed-on: https://gerrit.instructure.com/28581
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Marc LeGendre <marc@instructure.com>
QA-Review: Marc LeGendre <marc@instructure.com>