Check block header before accepting it.

Previously, AcceptBlockHeader did not check the header (in particular
PoW).  This made the client accept invalid-PoW-headers from peers in
headers-first sync.