don't mock 3rd party dependencies, reimplement the specs, refactor UserManager & UserSecureManager afterwards