switched User#update_all_passwords to work on ENV, expanded user tests