User: fix `confirm` permissions

Enable authentication for all User unit-tests to ensure the ACLs are
correctly configured.

Fix the rule for `confirm` - the correct permission is `ALLOW`, not
`ACL.ALLOW`.

Fix #677

/cc @raymondfeng @ritch I'll merge the patch without review, the change is trivial while the bug is critical.
This should be `ACL.ALLOW` (not a string).