User: fix `confirm` permissions

Enable authentication for all User unit-tests to check that the ACLs are
correctly configured.

Fix the rule for `confirm` - the correct permission is `ALLOW`, not
`ACL.ALLOW`.

common/models/user.json

@@ -75,7 +75,7 @@
     {
       "principalType": "ROLE",
       "principalId": "$everyone",
-      "permission": "ACL.ALLOW",
+      "permission": "ALLOW",
       "property": "confirm"
     },
     {

test/user.test.js

@@ -28,6 +28,7 @@ describe('User', function(){
   });
   
   beforeEach(function (done) {
+    app.enableAuth();
     app.use(loopback.token());
     app.use(loopback.rest());
     app.model(User);