In my experience, it differs between USB hosts (computers). Some (most?), especially generic desktop PCs seem not to cut out until 2A or more - presumably they have one larger fuse/PTC per bank of ports to save a few pence, rather than one per port. 2A is more than enough to do damage to small PCB traces! On the other hand, laptops and more power-conscious hosts, will enforce the 500 mA per port limit. I've noticed my MacBook Pros USB ports will strictly enforce the 500 mA limit, and show a message dialog and cut off the power if you go over that.
There is also the issue of how much current the USB device negotiates for during enumeration. If you're doing your own USB device (using the mbed D+/D- pair rather than via the mbed interface chip), then you can change this. The max is still 500 mA though. Finally, a compliant USB device is allowed some amount of current (100 mA I think) before enumeration, but if it wants more it has to negotiate for it. (In this respect, many, *many* devices are not compliant.)
There are also all manner of new USB sub-standards for things like OTG power, battery charging, USB car kits for mobile phones, and so on.
Summary: not as simple as it should be. Don't rely on the PTC/polyfuse protecting you (unless you know it wasn't cut out of your machines to make them cheaper :-). Best do a check in your own lab with your own machines.
I am about to unleash 50 students with mbed boards in our lab class here. It's just a matter of time until they short things out. So exactly what happens when they short 5V (or 3.3V) to GND on the protoboard. Does a PCB trace or some tiny SMT fuse blow out on the mbed or PC's USB hardware or are you OK?
We had some big protoboards in the past and had to put replaceable fuses on them to cut down on the smoke in the lab.
Someone out there has probably already done this and knows the answer.