A create-account submission with no token: work out who this is.

Unauthenticated of necessity -- nobody arriving here has a session -- and so throttled, since an unauthenticated endpoint that answers questions about an address is one an attacker will ask repeatedly. What it can be made to admit is bounded rather than eliminated: the paid-vs-not bit, and the same bit any sign-in screen gives up about whether a login exists. Wording is uniform within a branch so nothing finer than that gets out.