Tests for users.forms

I moved the password validation out of the field-specific method into the general form `clean()` method. There were some things about ordering and the population of `cleaned_data` that seemed odd.