account may be null on /account/keys

.gitignore

@@ -4,5 +4,5 @@
 /config/public-key.json
 /config/secret-key.json
 *.swp
-server.log
+server.log*
 /config/awsbox-secrets.json.gpg

routes/account.js

@@ -124,6 +124,9 @@ module.exports = function (log, crypto, uuid, isA, error, Account, RecoveryEmail
             .then(Account.get.bind(null, keyFetchToken.uid))
             .then(
               function (account) {
+                if (!account) {
+                  throw error.unknownAccount()
+                }
                 if (!account.verified) {
                   throw error.unverifiedAccount()
                 }