Check fingerprint before checking password (server linking)

Checking the password before the fingerprint means that even without the
correct cert it's possible to brute force the password or leak
information about it. Checking the fingerprint means attackers must
forge the cert before they can learn any information about the password.
m_spanningtree Send the cert fingerprint message to opers only after successful auth