Fix verify_password to check passwords more consistently

When verifying a password, the incoming password should be salted whenever
the stored password is not 'plaintext'. The decision to salt when
verifying existing passwords should not depend on the current value of
SECURITY_PASSWORD_HASH, as that may have changed since the password was
stored.

Commit 510d1356a2c2884c5895c321d1c8a65e1269b117 already fixed this issue
for verify_and_update_password. This makes verify_password work in the
same way.

Also fix a minor spelling error in documentation.