Enable authentication for all User unit-tests to check that the ACLs are correctly configured. Fix the rule for `confirm` - the correct permission is `ALLOW`, not `ACL.ALLOW`.