There were several problems:
* Time.now returns the systems time, not the users time
* fixtures do not translate dates from timezone to utc, but stores the
date verbatim
* calling a controller will set the timezone to the preference of the
current_user. So it could be changed while you do not realize this. I
fixed the failing test, but problems could be elsewhere
* Remove all methods implementing and checking for the old algorithm
* Document a pre-upgrade step to check for remaining obsolete passwords
* Remove config.salt
