User: fix `confirm` permissions

Enable authentication for all User unit-tests to check that the ACLs are
correctly configured.

Fix the rule for `confirm` - the correct permission is `ALLOW`, not
`ACL.ALLOW`.
Merge pull request #689 from strongloop/fix/user-acls

User: fix `confirm` permissions