Fix user role mass assignment from backend

This was broken by commit 175a23211337c9ba53242b54d19f84642989e984.

This specifically fixes two problems:
- #2905 Mass assignment exception when creating new users through backend
- #2904 Backend user gets logged into edited user account when changing
	password

Also update and unify core/auth admin user specs

- Add core admin create user spec
- Add auth admin create and edit user specs
- Merge badly namespaced auth user_spec into admin/users_spec