Rewrite PasswordController tests.

This didn't fix [refs #66585108] -- the problem was much simpler. But
the tests and controller are far easier to understand now.