Fix /users bugs
* cross-check password & passwordConfirmation
* fix specs