update verifierVersion on account reset and password change

This fixes the issue of accounts getting "locked out" when the `verifierVersion` changes and the password is changed. See #575

The test case is hairy and only covers the change password case, but honestly I'm tired of this issue...

r? @rfk