fixed testing bug whereby user factory sometimes generated too-short passwords