Fix security error, a bug and add pass update test

Security error was when the user is set, I keep on $user->password
the unencrypted password.
The bug was that when the user is updated, I don't update his
password only $user->password.