Update user.js

Corrected spacing on confirm ACL, removed extraneous comment on using hex rather than base64