UserPassword flow with routes and specs