Unconfirmed user accounts rendering

Originates in discussion: !546 (comment 11007)

We need to either show a small subset of data when rendering unconfirmed users or return 404.

TBD: if request contain multiple user identifiers and we decide to return 404 for single-user requests, should we exclude unconfirmed users' data from response or return 404 for the request?

Edited Dec 20, 2018 by Ivan Tashkinov