Added spec to prove user_plugins failure to update, per #2580
Issue #2580

Changed user_params to permit an array of plugins. Without this, user plugin access was not being persisted.