Unconfirmed user accounts rendering
Originates in discussion: !546 (comment 11007)
We need to either show a small subset of data when rendering unconfirmed users or return 404.
TBD: if request contain multiple user identifiers and we decide to return 404 for single-user requests, should we exclude unconfirmed users' data from response or return 404 for the request?