We should never be showing this publically.
Adds unit test for hiding verification token.
This is a back-port of pull request #1851 from gausie/patch-4
Enable authentication for all User unit-tests to check that the ACLs are
correctly configured.
Fix the rule for `confirm` - the correct permission is `ALLOW`, not
`ACL.ALLOW`.