Referring to the account is clearer. Also add account recovery
integration tests, and a test fixture with encryption keys.