fix a serious bug in /account/destroy

In the transition from a token to password auth on this
endpoint I forgot to check whether the password matches,
since before the token validated your credentials. This
allowed *anyone* to delete any account. oops!

@rfk r?