Client-side feedback while changing passwords

Note: not ready to be merged yet.

To do:

- [ ] add tests
- [ ] don't make each and every page load `zxcvbn.js` (because it's 700K) - load it only for pages that need it
- [ ] agree on the alert message copy
- [ ] notify the user if the password is too short
- [ ] notify the user if the password and confirmation don't match
- [ ] make sure that the new widgets are accessible

Open questions:

- Should the tests be be capybara-poltergeist tests or jasmine?
- Do we need to pass the score from the frontend to the backend so we can track the number of times that a password was OK'ed by the frontend but rejected by the backend?