Add tests

Maybe - the `UserFactory` I added doesn't do anything with passwords, so I suspect this is a no-op at this point.