fix a serious bug in /account/destroy

in the transition from a token to password auth on this
endpoint I forgot to check whether the password matches,
since before the token validated your credentials. This
allowed *anyone* to delete any account. oops!
Merge pull request #504 from dannycoates/destroy-oops

fix a serious bug in /account/destroy