Close the Change Password dropdown on document click.

This adds a click listener to the document which closes the dropdown.
When the trigger link or the dropdown itself is clicked, we stop
the event's propagation so it doesn't get to the document.

Because React event listeners are actually on the document (event delegation),
we have to use `stopImmediatePropagation` to prevent handlers from being called
for that same node.

Resolves #298.