Close online-dictionary attack opportunity

This commit makes the various access control errors in /wallets/update
respond in the same way, preventing an attacker from validating a password
using the endpoint, even if they don't have the authToken.