Order UserPasswords by id

created_at is not unique within one second, this breaks MySQL tests.

id is guaranteed to be unique and monotonically increasing on MySQL
and on Postgres(at least as long cache is not set for the sequence).