Add have_secure_password matcher w/behavior verification

I didn't realize that there was already an open PR for this, however I think this version addresses comments from the original #42 that #304 does not. This adds a `have_secure_password` matcher for Rails >= 3.1. It also works fine in Rails 4.0 but does not verify the newly-added :validations option.

I was originally also checking for the presence and confirmation validations that `ActiveModel::SecurePassword` adds but there are some implementation differences between Rails 3.1/2 and Rails 4.0. It seems like a better addition once shoulda-matchers test suite runs in Rails 4 (something I'm also looking at).