Security bug fix to act_as_system_user to restore correct user if an
exception is raised.  Also adds tests for act_as_system_user.

Also a minor style cleanup of "== []" to ".empty?" and some additional
checks to test "refuse to activate a user before signing UA".