Federico,
I don't see "account" in my requests (using learning locker). I'm not getting an errors from the LRS but I'm getting emtpy results so I'm not too confident yet in my settings. I'm thinking this might have something to do with your _xapiLaunchMethod. I think scorm uses an "account".
Here is an example of my activities/state call (using curl... names and keys changed to protect the innocent). The following returns "{}":
curl -i -H "Authorization: Basic ASDFSADSADSADFSRDFHFSGHREEGERGGDFHHETHDGDFGdsfgsdfgDFGERGHjfgjSFHGSHAERGGGDSFDfgdFDFSDFSDFHdsfhsdfhDSFSDFSDF" -H "X-Experience-API-Version:1.0.1" 'http://mylocallearninglockerURL.internal/data/xAPI/activities/state?activityId=http%3A%2F%2Fmycourseid%2F&agent=%7B%22objectType%22%3A%22Agent%22%2C%22name%22%3A%22John%20Doe%22%2C%22mbox%22%3A%22mailto%3Ajdoe%40doeenterprises.com%22%7D&stateId=ACTIVITY_STATE'