mozilla/fxa-auth-server — pull request #504 by dannycoates (2014-01-16 21:50:25+00:00)
Title: fix a serious bug in /account/destroy

In the transition from a token to password auth on this
endpoint I forgot to check whether the password matches,
since before the token validated your credentials. This
allowed *anyone* to delete any account. oops!

@rfk r?