CORE-444 deny account link

[dvoet]

https://broadworkbench.atlassian.net/browse/CORE-444

Have you read CONTRIBUTING.md lately? If not, do that first.

I, the developer opening this PR, do solemnly pinky swear that:

• I've followed the instructions if I've made any changes to the API, especially if they're breaking changes
• I've updated the FISMA documentation if I've made any security-related changes, including auth, encryption, or auditing

In all cases:

• Get two thumbsworth of review and PO signoff if necessary
• Verify all tests go green
• Squash and merge. Make sure your branch deletes; GitHub should do this for you.
• Test this change deployed correctly and works on dev environment after deployment