Passing build

Shows the dangers of stubbing and not restoring :grin: 

We stubbed `crypto.randomBytes`, which the User model is dependent on for hashing passwords, and then didn't restore it. Fun ensued!

Significant change is on [L31](https://github.com/unepwcmc/NRT/pull/300/files#diff-774884566d81585c4348effa5c0824cdL31), the rest is merely some refactoring of the `User` model tests so they report errors more consistently (using `done(err)` etc.).