Also return 404 when the user who sent the activity is believed to be deactivated. It was already an error, now it just returns a better reason than "Invalid request". Also send proper errors when either user is not known at all.
