User: fix `confirm` permissions

Enable authentication for all User unit-tests to check that the ACLs are
correctly configured.

Fix the rule for `confirm` - the correct permission is `ALLOW`, not
`ACL.ALLOW`.