Check fingerprint before checking password

Checking the password before the fingerprint means that even without the
correct cert it's possible to brute force the password or leak
information about it. Checking the fingerprint means attackers must
forge the cert before they can learn any information about the password.