Tests for users.forms

I moved the password validation out of the field-specific method into the general form `clean()` method. There were some things about ordering and the population of `cleaned_data` that seemed odd.
This clean_password2 validation is actually the way Django does it, despite the fact that they recommend against accessing other fields from `clean_foo` methods.