fix(client): Check the user's old password before attempting a change password.

* Add 'checkPassword' to fxa-client.js
* Check the user's pasword before checking whether the passwords are the same.

fixes #1118

@zaach and @vladikoff - wanna check it out?
@zaach - I remember now. I didn't want to add potential "one view only" error messages to AuthErrors. If no other fxa-js-client calls return `UNVERIFIED_ACCOUNT`, we can rethink that decision.