Passing build

Shows the dangers of stubbing and not restoring :grin: 

We stubbed `crypto.randomBytes`, which the User model is dependent on for hashing passwords, and then didn't restore it. Fun ensued!

Significant change is on L33, the rest is merely some refactoring of the `User` model tests so they report errors more consistently (using `done(err)` etc.).