Validate a One-Time Password

Validate that the supplied password is the same as that supplied to the
requested client. A 204 response will be returned on a valid password,
and a 400 on an invalid one. In order for a password to be valid, it
must:

1. Match the password sent to the target client as the result of a previous GET request
2. Have been requested no more than five minutes prior to this request being sent
3. Has not been invalidated by a later GET request