Change API calls that expect non-robots to explicitly filter

Before this change, we'd filter in the UI but calls to the API could allow robots accounts where we only expect real users

data/model/legacy.py

@@ -642,6 +642,13 @@ def find_user_by_email(email):
     return None
 
 
+def get_nonrobot_user(username):
+  try:
+    return User.get(User.username == username, User.organization == False, User.robot == False)
+  except User.DoesNotExist:
+    return None
+
+
 def get_user(username):
   try:
     return User.get(User.username == username, User.organization == False)