More tests for User model.

Don't force password confirmation (let controller do that).
Add more UTs.