checkPassword API

Draft for https://github.com/mozilla/fxa-auth-db-server/issues/88
I'm uneasy about this sort of type coercion; if the code expects an array then we should pass in an array uniformly.  Is the problem here that other callers of this function are passing in scalar values rather than arrays?