diff --git a/Gemfile b/Gemfile
index 5bbb86393..25f58a702 100644
--- a/Gemfile
+++ b/Gemfile
@@ -26,6 +26,7 @@ group :development, :test do
 
   # testing
   # gem 'spring'
+  gem 'factory_bot_rails'
   gem 'faker'
   gem 'fuzz_ball'
   gem 'guard'
@@ -33,9 +34,10 @@ group :development, :test do
   gem 'minitest'
   gem 'minitest-focus'
   gem 'minitest-rails'
-  gem 'minitest-reporters'
+  gem 'minitest-reporters', '1.1.18'
   gem 'mocha', '>= 1.5'
   gem 'pry'
+  gem 'pry-byebug'
   gem 'pry-remote'
 
   gem 'rubocop', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 023b1162a..72cd2cad5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -90,6 +90,7 @@ GEM
       encryptor (~> 3.0.0)
     bcrypt (3.1.11)
     builder (3.2.3)
+    byebug (10.0.2)
     codeclimate-test-reporter (1.0.8)
       simplecov (<= 0.13)
     coderay (1.1.1)
@@ -104,8 +105,13 @@ GEM
     docile (1.1.5)
     encryptor (3.0.0)
     erubi (1.7.0)
-    faker (1.7.3)
-      i18n (~> 0.5)
+    factory_bot (4.10.0)
+      activesupport (>= 3.0.0)
+    factory_bot_rails (4.10.0)
+      factory_bot (~> 4.10.0)
+      railties (>= 3.0.0)
+    faker (1.9.1)
+      i18n (>= 0.7)
     faraday (0.11.0)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
@@ -137,7 +143,7 @@ GEM
       guard-compat (~> 1.2)
       minitest (>= 3.0)
     hashie (3.5.5)
-    i18n (0.9.1)
+    i18n (0.9.5)
       concurrent-ruby (~> 1.0)
     json (2.1.0)
     jwt (1.5.6)
@@ -155,7 +161,7 @@ GEM
     method_source (0.8.2)
     mini_mime (1.0.0)
     mini_portile2 (2.3.0)
-    minitest (5.11.1)
+    minitest (5.11.3)
     minitest-focus (1.1.2)
       minitest (>= 4, < 6)
     minitest-rails (3.0.0)
@@ -203,6 +209,9 @@ GEM
       coderay (~> 1.1.0)
       method_source (~> 0.8.1)
       slop (~> 3.4)
+    pry-byebug (3.6.0)
+      byebug (~> 10.0)
+      pry (~> 0.10)
     pry-remote (0.1.8)
       pry (~> 0.9)
       slop (~> 3.0)
@@ -293,6 +302,7 @@ DEPENDENCIES
   attr_encrypted
   codeclimate-test-reporter
   devise_token_auth!
+  factory_bot_rails
   faker
   figaro!
   fuzz_ball
@@ -302,7 +312,7 @@ DEPENDENCIES
   minitest
   minitest-focus
   minitest-rails
-  minitest-reporters
+  minitest-reporters (= 1.1.18)
   mocha (>= 1.5)
   mysql2
   omniauth-facebook!
@@ -310,6 +320,7 @@ DEPENDENCIES
   omniauth-google-oauth2!
   pg
   pry
+  pry-byebug
   pry-remote
   rack-cors
   rails-controller-testing
diff --git a/gemfiles/rails_4_2.gemfile b/gemfiles/rails_4_2.gemfile
index b3595939c..ed0fb0e5a 100644
--- a/gemfiles/rails_4_2.gemfile
+++ b/gemfiles/rails_4_2.gemfile
@@ -1,43 +1,42 @@
-# frozen_string_literal: true
-
 # This file was generated by Appraisal
 
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
-gem 'mysql2', '~> 0.4.10'
-gem 'pg', '~> 0.21'
-gem 'rails', '~> 4.2.10'
+gem "mysql2", "~> 0.4.10"
+gem "pg", "~> 0.21"
+gem "rails", "~> 4.2.10"
 
 group :development, :test do
-  gem 'attr_encrypted'
-  gem 'figaro', git: 'https://github.com/laserlemon/figaro'
-  gem 'omniauth-facebook', git: 'https://github.com/mkdynamic/omniauth-facebook'
-  gem 'omniauth-github', git: 'https://github.com/intridea/omniauth-github'
-  gem 'omniauth-google-oauth2', git: 'https://github.com/zquestz/omniauth-google-oauth2'
-  gem 'rack-cors', require: 'rack/cors'
-  gem 'thor'
-  gem 'faker'
-  gem 'fuzz_ball'
-  gem 'guard'
-  gem 'guard-minitest'
-  gem 'minitest'
-  gem 'minitest-focus'
-  gem 'minitest-rails'
-  gem 'minitest-reporters'
-  gem 'mocha', '>= 1.5'
-  gem 'pry'
-  gem 'pry-remote'
-
-  gem 'rubocop', require: false
+  gem "attr_encrypted"
+  gem "figaro", git: "https://github.com/laserlemon/figaro"
+  gem "omniauth-facebook", git: "https://github.com/mkdynamic/omniauth-facebook"
+  gem "omniauth-github", git: "https://github.com/intridea/omniauth-github"
+  gem "omniauth-google-oauth2", git: "https://github.com/zquestz/omniauth-google-oauth2"
+  gem "rack-cors", require: "rack/cors"
+  gem "thor"
+  gem "factory_bot_rails"
+  gem "faker"
+  gem "fuzz_ball"
+  gem "guard"
+  gem "guard-minitest"
+  gem "minitest"
+  gem "minitest-focus"
+  gem "minitest-rails"
+  gem "minitest-reporters", "1.1.18"
+  gem "mocha", ">= 1.5"
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "rubocop", require: false
 end
 
 group :test do
-  gem 'codeclimate-test-reporter', require: nil
-  gem 'rails-controller-testing'
+  gem "codeclimate-test-reporter", require: nil
+  gem "rails-controller-testing"
 end
 
 group :development do
-  gem 'github_changelog_generator'
+  gem "github_changelog_generator"
 end
 
-gemspec path: '../'
+gemspec path: "../"
diff --git a/gemfiles/rails_5_0.gemfile b/gemfiles/rails_5_0.gemfile
index 52920e43e..846fec1ec 100644
--- a/gemfiles/rails_5_0.gemfile
+++ b/gemfiles/rails_5_0.gemfile
@@ -1,41 +1,40 @@
-# frozen_string_literal: true
-
 # This file was generated by Appraisal
 
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
-gem 'rails', '~> 5.0.7'
+gem "rails", "~> 5.0.7"
 
 group :development, :test do
-  gem 'attr_encrypted'
-  gem 'figaro', git: 'https://github.com/laserlemon/figaro'
-  gem 'omniauth-facebook', git: 'https://github.com/mkdynamic/omniauth-facebook'
-  gem 'omniauth-github', git: 'https://github.com/intridea/omniauth-github'
-  gem 'omniauth-google-oauth2', git: 'https://github.com/zquestz/omniauth-google-oauth2'
-  gem 'rack-cors', require: 'rack/cors'
-  gem 'thor'
-  gem 'faker'
-  gem 'fuzz_ball'
-  gem 'guard'
-  gem 'guard-minitest'
-  gem 'minitest'
-  gem 'minitest-focus'
-  gem 'minitest-rails'
-  gem 'minitest-reporters'
-  gem 'mocha', '>= 1.5'
-  gem 'pry'
-  gem 'pry-remote'
-
-  gem 'rubocop', require: false
+  gem "attr_encrypted"
+  gem "figaro", git: "https://github.com/laserlemon/figaro"
+  gem "omniauth-facebook", git: "https://github.com/mkdynamic/omniauth-facebook"
+  gem "omniauth-github", git: "https://github.com/intridea/omniauth-github"
+  gem "omniauth-google-oauth2", git: "https://github.com/zquestz/omniauth-google-oauth2"
+  gem "rack-cors", require: "rack/cors"
+  gem "thor"
+  gem "factory_bot_rails"
+  gem "faker"
+  gem "fuzz_ball"
+  gem "guard"
+  gem "guard-minitest"
+  gem "minitest"
+  gem "minitest-focus"
+  gem "minitest-rails"
+  gem "minitest-reporters", "1.1.18"
+  gem "mocha", ">= 1.5"
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "rubocop", require: false
 end
 
 group :test do
-  gem 'codeclimate-test-reporter', require: nil
-  gem 'rails-controller-testing'
+  gem "codeclimate-test-reporter", require: nil
+  gem "rails-controller-testing"
 end
 
 group :development do
-  gem 'github_changelog_generator'
+  gem "github_changelog_generator"
 end
 
-gemspec path: '../'
+gemspec path: "../"
diff --git a/gemfiles/rails_5_1.gemfile b/gemfiles/rails_5_1.gemfile
index bfbb4c186..ac13d2c2a 100644
--- a/gemfiles/rails_5_1.gemfile
+++ b/gemfiles/rails_5_1.gemfile
@@ -1,41 +1,40 @@
-# frozen_string_literal: true
-
 # This file was generated by Appraisal
 
-source 'https://rubygems.org'
+source "https://rubygems.org"
 
-gem 'rails', '~> 5.1.6'
+gem "rails", "~> 5.1.6"
 
 group :development, :test do
-  gem 'attr_encrypted'
-  gem 'figaro', git: 'https://github.com/laserlemon/figaro'
-  gem 'omniauth-facebook', git: 'https://github.com/mkdynamic/omniauth-facebook'
-  gem 'omniauth-github', git: 'https://github.com/intridea/omniauth-github'
-  gem 'omniauth-google-oauth2', git: 'https://github.com/zquestz/omniauth-google-oauth2'
-  gem 'rack-cors', require: 'rack/cors'
-  gem 'thor'
-  gem 'faker'
-  gem 'fuzz_ball'
-  gem 'guard'
-  gem 'guard-minitest'
-  gem 'minitest'
-  gem 'minitest-focus'
-  gem 'minitest-rails'
-  gem 'minitest-reporters'
-  gem 'mocha', '>= 1.5'
-  gem 'pry'
-  gem 'pry-remote'
-
-  gem 'rubocop', require: false
+  gem "attr_encrypted"
+  gem "figaro", git: "https://github.com/laserlemon/figaro"
+  gem "omniauth-facebook", git: "https://github.com/mkdynamic/omniauth-facebook"
+  gem "omniauth-github", git: "https://github.com/intridea/omniauth-github"
+  gem "omniauth-google-oauth2", git: "https://github.com/zquestz/omniauth-google-oauth2"
+  gem "rack-cors", require: "rack/cors"
+  gem "thor"
+  gem "factory_bot_rails"
+  gem "faker"
+  gem "fuzz_ball"
+  gem "guard"
+  gem "guard-minitest"
+  gem "minitest"
+  gem "minitest-focus"
+  gem "minitest-rails"
+  gem "minitest-reporters", "1.1.18"
+  gem "mocha", ">= 1.5"
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "rubocop", require: false
 end
 
 group :test do
-  gem 'codeclimate-test-reporter', require: nil
-  gem 'rails-controller-testing'
+  gem "codeclimate-test-reporter", require: nil
+  gem "rails-controller-testing"
 end
 
 group :development do
-  gem 'github_changelog_generator'
+  gem "github_changelog_generator"
 end
 
-gemspec path: '../'
+gemspec path: "../"
diff --git a/test/controllers/custom/custom_confirmations_controller_test.rb b/test/controllers/custom/custom_confirmations_controller_test.rb
index f680ba194..1e4199c42 100644
--- a/test/controllers/custom/custom_confirmations_controller_test.rb
+++ b/test/controllers/custom/custom_confirmations_controller_test.rb
@@ -4,9 +4,11 @@
 
 class Custom::ConfirmationsControllerTest < ActionController::TestCase
   describe Custom::ConfirmationsController do
+    include CustomControllersRoutes
+    
     before do
       @redirect_url = Faker::Internet.url
-      @new_user = users(:unconfirmed_email_user)
+      @new_user = create(:user)
       @new_user.send_confirmation_instructions(redirect_url: @redirect_url)
       @mail          = ActionMailer::Base.deliveries.last
       @token         = @mail.body.match(/confirmation_token=([^&]*)&/)[1]
diff --git a/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb b/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb
index 32077dfa6..13564a541 100644
--- a/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb
+++ b/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb
@@ -4,6 +4,8 @@
 
 class Custom::OmniauthCallbacksControllerTest < ActionDispatch::IntegrationTest
   describe Custom::OmniauthCallbacksController do
+    include CustomControllersRoutes
+
     setup do
       OmniAuth.config.test_mode = true
       OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
diff --git a/test/controllers/custom/custom_passwords_controller_test.rb b/test/controllers/custom/custom_passwords_controller_test.rb
index d2f7ea0cd..e3e1085fd 100644
--- a/test/controllers/custom/custom_passwords_controller_test.rb
+++ b/test/controllers/custom/custom_passwords_controller_test.rb
@@ -4,8 +4,10 @@
 
 class Custom::PasswordsControllerTest < ActionController::TestCase
   describe Custom::PasswordsController do
+    include CustomControllersRoutes
+
     before do
-      @resource = users(:confirmed_email_user)
+      @resource = create(:user, :confirmed)
       @redirect_url = 'http://ng-token-auth.dev'
     end
 
@@ -26,7 +28,7 @@ class Custom::PasswordsControllerTest < ActionController::TestCase
     end
 
     test 'yield resource to block on edit success' do
-      @resource = users(:unconfirmed_email_user)
+      @resource = create(:user)
       @redirect_url = 'http://ng-token-auth.dev'
 
       post :create,
diff --git a/test/controllers/custom/custom_registrations_controller_test.rb b/test/controllers/custom/custom_registrations_controller_test.rb
index d38b695a9..e2fcda095 100644
--- a/test/controllers/custom/custom_registrations_controller_test.rb
+++ b/test/controllers/custom/custom_registrations_controller_test.rb
@@ -4,16 +4,14 @@
 
 class Custom::RegistrationsControllerTest < ActionDispatch::IntegrationTest
   describe Custom::RegistrationsController do
-    setup do
-      @create_params = {
-        email: Faker::Internet.email,
-        password: 'secret123',
-        password_confirmation: 'secret123',
+    include CustomControllersRoutes
+
+    before do
+      @create_params = attributes_for(:user,
         confirm_success_url: Faker::Internet.url,
-        unpermitted_param: '(x_x)'
-      }
+        unpermitted_param: '(x_x)')
 
-      @existing_user = nice_users(:confirmed_email_user)
+      @existing_user = create(:user, :confirmed)
       @auth_headers  = @existing_user.create_new_auth_token
       @client_id     = @auth_headers['client']
 
diff --git a/test/controllers/custom/custom_sessions_controller_test.rb b/test/controllers/custom/custom_sessions_controller_test.rb
index 7a313bcb9..e2c83aa9a 100644
--- a/test/controllers/custom/custom_sessions_controller_test.rb
+++ b/test/controllers/custom/custom_sessions_controller_test.rb
@@ -4,17 +4,17 @@
 
 class Custom::SessionsControllerTest < ActionController::TestCase
   describe Custom::SessionsController do
+    include CustomControllersRoutes
+
     before do
-      @existing_user = users(:confirmed_email_user)
-      @existing_user.skip_confirmation!
-      @existing_user.save!
+      @existing_user = create(:user, :confirmed)
     end
 
     test 'yield resource to block on create success' do
       post :create,
            params: {
              email: @existing_user.email,
-             password: 'secret123'
+             password: @existing_user.password
            }
       assert @controller.create_block_called?,
              'create failed to yield resource to provided block'
@@ -31,7 +31,7 @@ class Custom::SessionsControllerTest < ActionController::TestCase
     test 'render method override' do
       post :create,
            params: { email: @existing_user.email,
-                     password: 'secret123' }
+                     password: @existing_user.password }
       @data = JSON.parse(response.body)
       assert_equal @data['custom'], 'foo'
     end
diff --git a/test/controllers/custom/custom_token_validations_controller_test.rb b/test/controllers/custom/custom_token_validations_controller_test.rb
index 0f424ac6f..d6fd09ffb 100644
--- a/test/controllers/custom/custom_token_validations_controller_test.rb
+++ b/test/controllers/custom/custom_token_validations_controller_test.rb
@@ -4,10 +4,10 @@
 
 class Custom::TokenValidationsControllerTest < ActionDispatch::IntegrationTest
   describe Custom::TokenValidationsController do
+    include CustomControllersRoutes
+
     before do
-      @resource = nice_users(:confirmed_email_user)
-      @resource.skip_confirmation!
-      @resource.save!
+      @resource = create(:user, :confirmed)
 
       @auth_headers = @resource.create_new_auth_token
 
diff --git a/test/controllers/demo_group_controller_test.rb b/test/controllers/demo_group_controller_test.rb
index 374c3bf60..65680a82e 100644
--- a/test/controllers/demo_group_controller_test.rb
+++ b/test/controllers/demo_group_controller_test.rb
@@ -13,9 +13,7 @@ class DemoGroupControllerTest < ActionDispatch::IntegrationTest
     describe 'Token access' do
       before do
         # user
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
 
         @resource_auth_headers = @resource.create_new_auth_token
 
@@ -24,9 +22,7 @@ class DemoGroupControllerTest < ActionDispatch::IntegrationTest
         @resource_expiry    = @resource_auth_headers['expiry']
 
         # mang
-        @mang = mangs(:confirmed_email_user)
-        @mang.skip_confirmation!
-        @mang.save!
+        @mang = create(:mang_user, :confirmed)
 
         @mang_auth_headers = @mang.create_new_auth_token
 
diff --git a/test/controllers/demo_mang_controller_test.rb b/test/controllers/demo_mang_controller_test.rb
index 7d410196e..887f510a2 100644
--- a/test/controllers/demo_mang_controller_test.rb
+++ b/test/controllers/demo_mang_controller_test.rb
@@ -12,9 +12,7 @@ class DemoMangControllerTest < ActionDispatch::IntegrationTest
   describe DemoMangController do
     describe 'Token access' do
       before do
-        @resource = mangs(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:mang_user, :confirmed)
 
         @auth_headers = @resource.create_new_auth_token
 
diff --git a/test/controllers/demo_user_controller_test.rb b/test/controllers/demo_user_controller_test.rb
index 252fb5ccf..b4aea3518 100644
--- a/test/controllers/demo_user_controller_test.rb
+++ b/test/controllers/demo_user_controller_test.rb
@@ -13,9 +13,7 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
   describe DemoUserController do
     describe 'Token access' do
       before do
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
 
         @auth_headers = @resource.create_new_auth_token
 
@@ -457,8 +455,7 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
 
     describe 'bypass_sign_in' do
       before do
-        @resource = users(:unconfirmed_email_user)
-        @resource.save!
+        @resource = create(:user)
 
         @auth_headers = @resource.create_new_auth_token
 
@@ -513,16 +510,14 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
 
     describe 'enable_standard_devise_support' do
       before do
-        @resource = users(:confirmed_email_user)
+        @resource = create(:user, :confirmed)
         @auth_headers = @resource.create_new_auth_token
         DeviseTokenAuth.enable_standard_devise_support = true
       end
 
       describe 'Existing Warden authentication' do
         before do
-          @resource = users(:second_confirmed_email_user)
-          @resource.skip_confirmation!
-          @resource.save!
+          @resource = create(:user, :confirmed)
           login_as(@resource, scope: :user)
 
           # no auth headers sent, testing that warden authenticates correctly.
@@ -574,9 +569,7 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
 
       describe 'existing Warden authentication with ignored token data' do
         before do
-          @resource = users(:second_confirmed_email_user)
-          @resource.skip_confirmation!
-          @resource.save!
+          @resource = create(:user, :confirmed)
           login_as(@resource, scope: :user)
 
           get '/demo/members_only',
diff --git a/test/controllers/devise_token_auth/confirmations_controller_test.rb b/test/controllers/devise_token_auth/confirmations_controller_test.rb
index dc719f86c..63eae0e56 100644
--- a/test/controllers/devise_token_auth/confirmations_controller_test.rb
+++ b/test/controllers/devise_token_auth/confirmations_controller_test.rb
@@ -19,7 +19,7 @@ def token_and_client_config_from(body)
     describe 'Confirmation' do
       before do
         @redirect_url = Faker::Internet.url
-        @new_user = users(:unconfirmed_email_user)
+        @new_user = create(:user)
         @new_user.send_confirmation_instructions(redirect_url: @redirect_url)
         mail = ActionMailer::Base.deliveries.last
         @token, @client_config = token_and_client_config_from(mail.body)
@@ -90,7 +90,7 @@ def token_and_client_config_from(body)
 
       before do
         @config_name = 'altUser'
-        @new_user    = mangs(:unconfirmed_email_user)
+        @new_user    = create(:mang_user)
 
         @new_user.send_confirmation_instructions(client_config: @config_name)
 
diff --git a/test/controllers/devise_token_auth/passwords_controller_test.rb b/test/controllers/devise_token_auth/passwords_controller_test.rb
index 98797b774..c47bcfafd 100644
--- a/test/controllers/devise_token_auth/passwords_controller_test.rb
+++ b/test/controllers/devise_token_auth/passwords_controller_test.rb
@@ -12,7 +12,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
   describe DeviseTokenAuth::PasswordsController do
     describe 'Password reset' do
       before do
-        @resource = users(:confirmed_email_user)
+        @resource = create(:user, :confirmed)
         @redirect_url = 'http://ng-token-auth.dev'
       end
 
@@ -320,7 +320,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
 
       describe 'Using default_password_reset_url' do
         before do
-          @resource = users(:confirmed_email_user)
+          @resource = create(:user, :confirmed)
           @redirect_url = 'http://ng-token-auth.dev'
 
           DeviseTokenAuth.default_password_reset_url = @redirect_url
@@ -354,7 +354,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
 
       describe 'Using redirect_whitelist' do
         before do
-          @resource = users(:confirmed_email_user)
+          @resource = create(:user, :confirmed)
           @good_redirect_url = Faker::Internet.url
           @bad_redirect_url = Faker::Internet.url
           DeviseTokenAuth.redirect_whitelist = [@good_redirect_url]
@@ -552,7 +552,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
       end
 
       before do
-        @resource = mangs(:confirmed_email_user)
+        @resource = create(:mang_user, :confirmed)
         @redirect_url = 'http://ng-token-auth.dev'
 
         post :create, params: { email: @resource.email,
@@ -579,7 +579,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
 
     describe 'unconfirmed user' do
       before do
-        @resource = users(:unconfirmed_email_user)
+        @resource = create(:user)
         @redirect_url = 'http://ng-token-auth.dev'
 
         post :create, params: { email: @resource.email,
@@ -631,7 +631,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
 
     describe 'alternate user type' do
       before do
-        @resource = users(:confirmed_email_user)
+        @resource = create(:user, :confirmed)
         @redirect_url = 'http://ng-token-auth.dev'
         @config_name  = 'altUser'
 
diff --git a/test/controllers/devise_token_auth/registrations_controller_test.rb b/test/controllers/devise_token_auth/registrations_controller_test.rb
index d57a079a3..189f5b019 100644
--- a/test/controllers/devise_token_auth/registrations_controller_test.rb
+++ b/test/controllers/devise_token_auth/registrations_controller_test.rb
@@ -376,7 +376,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
 
     describe 'Existing users' do
       before do
-        @existing_user = users(:confirmed_email_user)
+        @existing_user = create(:user, :confirmed)
 
         post '/auth',
              params: { email: @existing_user.email,
@@ -404,7 +404,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
     describe 'Destroy user account' do
       describe 'success' do
         before do
-          @existing_user = users(:confirmed_email_user)
+          @existing_user = create(:user, :confirmed)
           @auth_headers  = @existing_user.create_new_auth_token
           @client_id     = @auth_headers['client']
 
@@ -451,7 +451,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
     describe 'Update user account' do
       describe 'existing user' do
         before do
-          @existing_user = users(:confirmed_email_user)
+          @existing_user = create(:user, :confirmed)
           @auth_headers  = @existing_user.create_new_auth_token
           @client_id     = @auth_headers['client']
 
@@ -499,13 +499,13 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
             end
 
             test 'Supply current password' do
-              @request_params[:current_password] = 'secret123'
-              @request_params[:email] = 'new.email@example.com'
+              @request_params[:current_password] = @existing_user.password
+              @request_params[:email] = @existing_user.email
 
               put '/auth', params: @request_params, headers: @auth_headers
               @data = JSON.parse(response.body)
               @existing_user.reload
-              assert_equal @existing_user.email, 'new.email@example.com'
+              assert_equal @existing_user.email, @request_params[:email]
             end
           end
 
@@ -668,7 +668,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
 
       describe 'invalid user' do
         before do
-          @existing_user = users(:confirmed_email_user)
+          @existing_user = create(:user, :confirmed)
           @auth_headers  = @existing_user.create_new_auth_token
           @client_id     = @auth_headers['client']
 
@@ -705,7 +705,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
 
     describe 'Ouath user has existing email' do
       before do
-        @existing_user = users(:duplicate_email_facebook_user)
+        @existing_user = create(:user, :facebook, :confirmed)
 
         post '/auth',
              params: { email: @existing_user.email,
diff --git a/test/controllers/devise_token_auth/sessions_controller_test.rb b/test/controllers/devise_token_auth/sessions_controller_test.rb
index 932530120..f6e844071 100644
--- a/test/controllers/devise_token_auth/sessions_controller_test.rb
+++ b/test/controllers/devise_token_auth/sessions_controller_test.rb
@@ -12,9 +12,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
   describe DeviseTokenAuth::SessionsController do
     describe 'Confirmed user' do
       before do
-        @existing_user = users(:confirmed_email_user)
-        @existing_user.skip_confirmation!
-        @existing_user.save!
+        @existing_user = create(:user, :with_nickname, :confirmed)
       end
 
       describe 'success' do
@@ -28,7 +26,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
           post :create,
                params: {
                  email: @existing_user.email,
-                 password: 'secret123'
+                 password: @existing_user.password
                }
 
           @resource = assigns(:resource)
@@ -84,7 +82,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
 
             @user_session_params = {
               email: @existing_user.email,
-              password: 'secret123'
+              password: @existing_user.password
             }
           end
 
@@ -130,7 +128,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
         before do
           get :new,
               params: { nickname: @existing_user.nickname,
-                        password: 'secret123' }
+                        password: @existing_user.password }
           @data = JSON.parse(response.body)
         end
 
@@ -147,7 +145,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
         before do
           request.headers.merge!(
             'email' => @existing_user.email,
-            'password' => 'secret123'
+            'password' => @existing_user.password
           )
 
           head :create
@@ -163,7 +161,7 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
         before do
           post :create,
                params: { nickname: @existing_user.nickname,
-                         password: 'secret123' }
+                         password: @existing_user.password }
           @data = JSON.parse(response.body)
         end
 
@@ -275,7 +273,7 @@ def @controller.reset_session
           @resource_class = User
           @request_params = {
             email: @existing_user.email.upcase,
-            password: 'secret123'
+            password: @existing_user.password
           }
         end
 
@@ -298,7 +296,7 @@ def @controller.reset_session
           @request_params = {
             # adding whitespace before and after email
             email: " #{@existing_user.email}  ",
-            password: 'secret123'
+            password: @existing_user.password
           }
         end
 
@@ -318,9 +316,9 @@ def @controller.reset_session
 
     describe 'Unconfirmed user' do
       before do
-        @unconfirmed_user = users(:unconfirmed_email_user)
+        @unconfirmed_user = create(:user)
         post :create, params: { email: @unconfirmed_user.email,
-                                password: 'secret123' }
+                                password: @unconfirmed_user.password }
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
       end
@@ -341,10 +339,10 @@ def @controller.reset_session
       before do
         @original_duration = Devise.allow_unconfirmed_access_for
         Devise.allow_unconfirmed_access_for = 3.days
-        @recent_unconfirmed_user = users(:recent_unconfirmed_email_user)
+        @recent_unconfirmed_user = create(:user)
         post :create,
              params: { email: @recent_unconfirmed_user.email,
-                       password: 'secret123' }
+                       password: @recent_unconfirmed_user.password }
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
       end
@@ -364,20 +362,14 @@ def @controller.reset_session
 
     describe 'Unconfirmed user with expired unconfirmed access' do
       before do
-        @original_duration = Devise.allow_unconfirmed_access_for
-        Devise.allow_unconfirmed_access_for = 3.days
-        @unconfirmed_user = users(:unconfirmed_email_user)
+        @unconfirmed_user = create(:user, :unconfirmed)
         post :create,
              params: { email: @unconfirmed_user.email,
-                       password: 'secret123' }
+                       password: @unconfirmed_user.password }
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
       end
 
-      after do
-        Devise.allow_unconfirmed_access_for = @original_duration
-      end
-
       test 'request should fail' do
         assert_equal 401, response.status
       end
@@ -415,13 +407,11 @@ def @controller.reset_session
       end
 
       before do
-        @existing_user = mangs(:confirmed_email_user)
-        @existing_user.skip_confirmation!
-        @existing_user.save!
+        @existing_user = create(:mang_user, :confirmed)
 
         post :create,
              params: { email: @existing_user.email,
-                       password: 'secret123' }
+                       password: @existing_user.password }
 
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
@@ -446,12 +436,11 @@ def @controller.reset_session
       end
 
       before do
-        @existing_user = only_email_users(:user)
-        @existing_user.save!
+        @existing_user = create(:only_email_user)
 
         post :create,
              params: { email: @existing_user.email,
-                       password: 'secret123' }
+                       password: @existing_user.password }
 
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
@@ -489,10 +478,10 @@ def @controller.reset_session
 
       describe 'locked user' do
         before do
-          @locked_user = lockable_users(:locked_user)
+          @locked_user = create(:lockable_user, :locked)
           post :create,
                params: { email: @locked_user.email,
-                         password: 'secret123' }
+                         password: @locked_user.password }
           @data = JSON.parse(response.body)
         end
 
@@ -508,7 +497,7 @@ def @controller.reset_session
 
       describe 'unlocked user with bad password' do
         before do
-          @unlocked_user = lockable_users(:unlocked_user)
+          @unlocked_user = create(:lockable_user)
           post :create,
                params: { email: @unlocked_user.email,
                          password: 'bad-password' }
diff --git a/test/controllers/devise_token_auth/token_validations_controller_test.rb b/test/controllers/devise_token_auth/token_validations_controller_test.rb
index dda39dc92..388d26c24 100644
--- a/test/controllers/devise_token_auth/token_validations_controller_test.rb
+++ b/test/controllers/devise_token_auth/token_validations_controller_test.rb
@@ -11,9 +11,7 @@
 class DeviseTokenAuth::TokenValidationsControllerTest < ActionDispatch::IntegrationTest
   describe DeviseTokenAuth::TokenValidationsController do
     before do
-      @resource = users(:confirmed_email_user)
-      @resource.skip_confirmation!
-      @resource.save!
+      @resource = create(:user, :confirmed)
 
       @auth_headers = @resource.create_new_auth_token
 
@@ -68,9 +66,7 @@ class DeviseTokenAuth::TokenValidationsControllerTest < ActionDispatch::Integrat
 
   describe 'using namespaces with unused resource' do
     before do
-      @resource = scoped_users(:confirmed_email_user)
-      @resource.skip_confirmation!
-      @resource.save!
+      @resource = create(:scoped_user, :confirmed)
 
       @auth_headers = @resource.create_new_auth_token
 
diff --git a/test/controllers/devise_token_auth/unlocks_controller_test.rb b/test/controllers/devise_token_auth/unlocks_controller_test.rb
index 59969ee88..ef5cd7953 100644
--- a/test/controllers/devise_token_auth/unlocks_controller_test.rb
+++ b/test/controllers/devise_token_auth/unlocks_controller_test.rb
@@ -35,7 +35,7 @@ class DeviseTokenAuth::UnlocksControllerTest < ActionController::TestCase
 
     describe 'Unlocking user' do
       before do
-        @resource = lockable_users(:unlocked_user)
+        @resource = create(:lockable_user)
       end
 
       describe 'request unlock without email' do
diff --git a/test/controllers/overrides/confirmations_controller_test.rb b/test/controllers/overrides/confirmations_controller_test.rb
index 78dd6a924..bad501347 100644
--- a/test/controllers/overrides/confirmations_controller_test.rb
+++ b/test/controllers/overrides/confirmations_controller_test.rb
@@ -9,10 +9,12 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::ConfirmationsControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::ConfirmationsController do
     before do
       @redirect_url = Faker::Internet.url
-      @new_user = evil_users(:unconfirmed_email_user)
+      @new_user = create(:user)
 
       # generate + send email
       @new_user.send_confirmation_instructions(redirect_url: @redirect_url)
diff --git a/test/controllers/overrides/omniauth_callbacks_controller_test.rb b/test/controllers/overrides/omniauth_callbacks_controller_test.rb
index 1ee782559..224e0294a 100644
--- a/test/controllers/overrides/omniauth_callbacks_controller_test.rb
+++ b/test/controllers/overrides/omniauth_callbacks_controller_test.rb
@@ -9,8 +9,10 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::OmniauthCallbacksControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::OmniauthCallbacksController do
-    setup do
+    before do
       OmniAuth.config.test_mode = true
       OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
         provider: 'facebook',
diff --git a/test/controllers/overrides/passwords_controller_test.rb b/test/controllers/overrides/passwords_controller_test.rb
index e04a80530..b3a266f3d 100644
--- a/test/controllers/overrides/passwords_controller_test.rb
+++ b/test/controllers/overrides/passwords_controller_test.rb
@@ -9,9 +9,11 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::PasswordsControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::PasswordsController do
     before do
-      @resource = evil_users(:confirmed_email_user)
+      @resource = create(:user, :confirmed)
 
       post '/evil_user_auth/password',
            params: {
diff --git a/test/controllers/overrides/registrations_controller_test.rb b/test/controllers/overrides/registrations_controller_test.rb
index 06c585fb3..63895a2c3 100644
--- a/test/controllers/overrides/registrations_controller_test.rb
+++ b/test/controllers/overrides/registrations_controller_test.rb
@@ -9,10 +9,12 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::RegistrationsControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::RegistrationsController do
     describe 'Succesful Registration update' do
-      setup do
-        @existing_user  = evil_users(:confirmed_email_user)
+      before do
+        @existing_user  = create(:user, :confirmed)
         @auth_headers   = @existing_user.create_new_auth_token
         @client_id      = @auth_headers['client']
         @favorite_color = 'pink'
diff --git a/test/controllers/overrides/sessions_controller_test.rb b/test/controllers/overrides/sessions_controller_test.rb
index 2fdcfa74b..0ed466468 100644
--- a/test/controllers/overrides/sessions_controller_test.rb
+++ b/test/controllers/overrides/sessions_controller_test.rb
@@ -9,15 +9,15 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::RegistrationsControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::RegistrationsController do
     before do
-      @existing_user = evil_users(:confirmed_email_user)
-      @existing_user.skip_confirmation!
-      @existing_user.save!
+      @existing_user = create(:user, :confirmed)
 
       post '/evil_user_auth/sign_in',
            params: { email: @existing_user.email,
-                     password: 'secret123' }
+                     password: @existing_user.password }
 
       @resource = assigns(:resource)
       @data = JSON.parse(response.body)
diff --git a/test/controllers/overrides/token_validations_controller_test.rb b/test/controllers/overrides/token_validations_controller_test.rb
index 880f868ff..4aeaba16e 100644
--- a/test/controllers/overrides/token_validations_controller_test.rb
+++ b/test/controllers/overrides/token_validations_controller_test.rb
@@ -9,11 +9,11 @@
 #  was the appropriate message delivered in the json payload?
 
 class Overrides::TokenValidationsControllerTest < ActionDispatch::IntegrationTest
+  include OverridesControllersRoutes
+
   describe Overrides::TokenValidationsController do
     before do
-      @resource = evil_users(:confirmed_email_user)
-      @resource.skip_confirmation!
-      @resource.save!
+      @resource = create(:user, :confirmed)
 
       @auth_headers = @resource.create_new_auth_token
 
diff --git a/test/dummy/app/models/evil_user.rb b/test/dummy/app/models/evil_user.rb
deleted file mode 100644
index 60a41fe0d..000000000
--- a/test/dummy/app/models/evil_user.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-class EvilUser < ActiveRecord::Base
-  include DeviseTokenAuth::Concerns::User
-end
diff --git a/test/dummy/app/models/nice_user.rb b/test/dummy/app/models/nice_user.rb
deleted file mode 100644
index 0e81f5ef8..000000000
--- a/test/dummy/app/models/nice_user.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class NiceUser < ActiveRecord::Base
-  # Include default devise modules.
-  devise :database_authenticatable, :registerable,
-         :recoverable, :rememberable, :trackable, :validatable,
-         :confirmable, :omniauthable
-  include DeviseTokenAuth::Concerns::User
-end
diff --git a/test/dummy/config/routes.rb b/test/dummy/config/routes.rb
index 47f57ea31..48d977c19 100644
--- a/test/dummy/config/routes.rb
+++ b/test/dummy/config/routes.rb
@@ -12,24 +12,6 @@
   # need to be defined within a devise_scope as shown below
   mount_devise_token_auth_for 'Mang', at: 'mangs'
 
-  mount_devise_token_auth_for 'EvilUser', at: 'evil_user_auth', controllers: {
-    confirmations:      'overrides/confirmations',
-    passwords:          'overrides/passwords',
-    omniauth_callbacks: 'overrides/omniauth_callbacks',
-    registrations:      'overrides/registrations',
-    sessions:           'overrides/sessions',
-    token_validations:  'overrides/token_validations'
-  }
-
-  mount_devise_token_auth_for 'NiceUser', at: 'nice_user_auth', controllers: {
-    registrations: 'custom/registrations',
-    confirmations: 'custom/confirmations',
-    passwords: 'custom/passwords',
-    sessions: 'custom/sessions',
-    token_validations: 'custom/token_validations',
-    omniauth_callbacks: 'custom/omniauth_callbacks'
-  }
-
   mount_devise_token_auth_for 'OnlyEmailUser', at: 'only_email_auth', skip: [:omniauth_callbacks]
 
   mount_devise_token_auth_for 'UnregisterableUser', at: 'unregisterable_user_auth', skip: [:registrations]
diff --git a/test/dummy/db/migrate/20140928231203_devise_token_auth_create_evil_users.rb b/test/dummy/db/migrate/20140928231203_devise_token_auth_create_evil_users.rb
deleted file mode 100644
index 0d53d32d6..000000000
--- a/test/dummy/db/migrate/20140928231203_devise_token_auth_create_evil_users.rb
+++ /dev/null
@@ -1,66 +0,0 @@
-# frozen_string_literal: true
-
-include MigrationDatabaseHelper
-
-class DeviseTokenAuthCreateEvilUsers < ActiveRecord::Migration[4.2]
-  def change
-    create_table(:evil_users) do |t|
-      ## Database authenticatable
-      t.string :email
-      t.string :encrypted_password, null: false, default: ''
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-      t.boolean  :allow_password_change, default: false
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
-      ## Confirmable
-      t.string   :confirmation_token
-      t.datetime :confirmed_at
-      t.datetime :confirmation_sent_at
-      t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Lockable
-      # t.integer  :failed_attempts, :default => 0, :null => false # Only if lock strategy is :failed_attempts
-      # t.string   :unlock_token # Only if unlock strategy is :email or :both
-      # t.datetime :locked_at
-
-      ## User Info
-      t.string :name
-      t.string :nickname
-      t.string :image
-
-      ## unique oauth id
-      t.string :provider
-      t.string :uid, null: false, default: ''
-
-      ## Tokens
-      if json_supported_database?
-        t.json :tokens
-      else
-        t.text :tokens
-      end
-
-      ## etc.
-      t.string :favorite_color
-
-      t.timestamps
-    end
-
-    add_index :evil_users, :email
-    add_index :evil_users, [:uid, :provider],     unique: true
-    add_index :evil_users, :reset_password_token, unique: true
-    add_index :evil_users, :confirmation_token,   unique: true
-    # add_index :evil_users, :unlock_token,         :unique => true
-  end
-end
diff --git a/test/dummy/db/migrate/20150409095712_devise_token_auth_create_nice_users.rb b/test/dummy/db/migrate/20150409095712_devise_token_auth_create_nice_users.rb
deleted file mode 100644
index b4e85cf79..000000000
--- a/test/dummy/db/migrate/20150409095712_devise_token_auth_create_nice_users.rb
+++ /dev/null
@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-include MigrationDatabaseHelper
-
-class DeviseTokenAuthCreateNiceUsers < ActiveRecord::Migration[4.2]
-  def change
-    create_table(:nice_users) do |t|
-      ## Required
-      t.string :provider, null: false
-      t.string :uid, null: false, default: ''
-
-      ## Database authenticatable
-      t.string :encrypted_password, null: false, default: ''
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-      t.boolean  :allow_password_change, default: false
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
-      ## Confirmable
-      t.string   :confirmation_token
-      t.datetime :confirmed_at
-      t.datetime :confirmation_sent_at
-      t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Lockable
-      # t.integer  :failed_attempts, :default => 0, :null => false # Only if lock strategy is :failed_attempts
-      # t.string   :unlock_token # Only if unlock strategy is :email or :both
-      # t.datetime :locked_at
-
-      ## User Info
-      t.string :name
-      t.string :nickname
-      t.string :image
-      t.string :email
-
-      ## Tokens
-      if json_supported_database?
-        t.json :tokens
-      else
-        t.text :tokens
-      end
-
-      t.timestamps
-    end
-
-    add_index :nice_users, :email
-    add_index :nice_users, [:uid, :provider],     unique: true
-    add_index :nice_users, :reset_password_token, unique: true
-    # add_index :nice_users, :confirmation_token,   :unique => true
-    # add_index :nice_users, :unlock_token,         :unique => true
-  end
-end
diff --git a/test/dummy/db/schema.rb b/test/dummy/db/schema.rb
index 7cb4e1a81..f34f8dd0a 100644
--- a/test/dummy/db/schema.rb
+++ b/test/dummy/db/schema.rb
@@ -14,247 +14,187 @@
 
 ActiveRecord::Schema.define(version: 20160629184441) do
 
-  create_table 'evil_users', force: :cascade do |t|
-    t.string 'email'
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'provider'
-    t.string 'uid', default: '', null: false
-    t.text 'tokens'
-    t.string 'favorite_color'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['confirmation_token'], name: 'index_evil_users_on_confirmation_token', unique: true
-    t.index ['email'], name: 'index_evil_users_on_email'
-    t.index ['reset_password_token'], name: 'index_evil_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_evil_users_on_uid_and_provider', unique: true
+  create_table "lockable_users", force: :cascade do |t|
+    t.string "provider", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.integer "failed_attempts", default: 0, null: false
+    t.string "unlock_token"
+    t.datetime "locked_at"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.index ["email"], name: "index_lockable_users_on_email"
+    t.index ["uid", "provider"], name: "index_lockable_users_on_uid_and_provider", unique: true
+    t.index ["unlock_token"], name: "index_lockable_users_on_unlock_token", unique: true
   end
 
-  create_table 'lockable_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.integer 'failed_attempts', default: 0, null: false
-    t.string 'unlock_token'
-    t.datetime 'locked_at'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_lockable_users_on_email'
-    t.index ['uid', 'provider'], name: 'index_lockable_users_on_uid_and_provider', unique: true
-    t.index ['unlock_token'], name: 'index_lockable_users_on_unlock_token', unique: true
+  create_table "mangs", force: :cascade do |t|
+    t.string "email"
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.string "reset_password_redirect_url"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.integer "sign_in_count", default: 0, null: false
+    t.datetime "current_sign_in_at"
+    t.datetime "last_sign_in_at"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "provider"
+    t.string "uid", default: "", null: false
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.string "favorite_color"
+    t.index ["confirmation_token"], name: "index_mangs_on_confirmation_token", unique: true
+    t.index ["email"], name: "index_mangs_on_email"
+    t.index ["reset_password_token"], name: "index_mangs_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_mangs_on_uid_and_provider", unique: true
   end
 
-  create_table 'mangs', force: :cascade do |t|
-    t.string 'email'
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.string 'reset_password_redirect_url'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'provider'
-    t.string 'uid', default: '', null: false
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.string 'favorite_color'
-    t.index ['confirmation_token'], name: 'index_mangs_on_confirmation_token', unique: true
-    t.index ['email'], name: 'index_mangs_on_email'
-    t.index ['reset_password_token'], name: 'index_mangs_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_mangs_on_uid_and_provider', unique: true
+  create_table "only_email_users", force: :cascade do |t|
+    t.string "provider", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.index ["email"], name: "index_only_email_users_on_email"
+    t.index ["uid", "provider"], name: "index_only_email_users_on_uid_and_provider", unique: true
   end
 
-  create_table 'nice_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_nice_users_on_email'
-    t.index ['reset_password_token'], name: 'index_nice_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_nice_users_on_uid_and_provider', unique: true
+  create_table "scoped_users", force: :cascade do |t|
+    t.string "provider", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.integer "sign_in_count", default: 0, null: false
+    t.datetime "current_sign_in_at"
+    t.datetime "last_sign_in_at"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.index ["email"], name: "index_scoped_users_on_email"
+    t.index ["reset_password_token"], name: "index_scoped_users_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_scoped_users_on_uid_and_provider", unique: true
   end
 
-  create_table 'only_email_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_only_email_users_on_email'
-    t.index ['uid', 'provider'], name: 'index_only_email_users_on_uid_and_provider', unique: true
+  create_table "unconfirmable_users", force: :cascade do |t|
+    t.string "provider", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.integer "sign_in_count", default: 0, null: false
+    t.datetime "current_sign_in_at"
+    t.datetime "last_sign_in_at"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.index ["email"], name: "index_unconfirmable_users_on_email"
+    t.index ["reset_password_token"], name: "index_unconfirmable_users_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_unconfirmable_users_on_uid_and_provider", unique: true
   end
 
-  create_table 'scoped_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_scoped_users_on_email'
-    t.index ['reset_password_token'], name: 'index_scoped_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_scoped_users_on_uid_and_provider', unique: true
+  create_table "unregisterable_users", force: :cascade do |t|
+    t.string "provider", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.integer "sign_in_count", default: 0, null: false
+    t.datetime "current_sign_in_at"
+    t.datetime "last_sign_in_at"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.index ["email"], name: "index_unregisterable_users_on_email"
+    t.index ["reset_password_token"], name: "index_unregisterable_users_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_unregisterable_users_on_uid_and_provider", unique: true
   end
 
-  create_table 'unconfirmable_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_unconfirmable_users_on_email'
-    t.index ['reset_password_token'], name: 'index_unconfirmable_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_unconfirmable_users_on_uid_and_provider', unique: true
-  end
-
-  create_table 'unregisterable_users', force: :cascade do |t|
-    t.string 'provider', null: false
-    t.string 'uid', default: '', null: false
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'email'
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.index ['email'], name: 'index_unregisterable_users_on_email'
-    t.index ['reset_password_token'], name: 'index_unregisterable_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_unregisterable_users_on_uid_and_provider', unique: true
-  end
-
-  create_table 'users', force: :cascade do |t|
-    t.string 'email'
-    t.string 'encrypted_password', default: '', null: false
-    t.string 'reset_password_token'
-    t.datetime 'reset_password_sent_at'
-    t.string 'reset_password_redirect_url'
-    t.boolean 'allow_password_change', default: false
-    t.datetime 'remember_created_at'
-    t.integer 'sign_in_count', default: 0, null: false
-    t.datetime 'current_sign_in_at'
-    t.datetime 'last_sign_in_at'
-    t.string 'current_sign_in_ip'
-    t.string 'last_sign_in_ip'
-    t.string 'confirmation_token'
-    t.datetime 'confirmed_at'
-    t.datetime 'confirmation_sent_at'
-    t.string 'unconfirmed_email'
-    t.string 'name'
-    t.string 'nickname'
-    t.string 'image'
-    t.string 'provider'
-    t.string 'uid', default: '', null: false
-    t.text 'tokens'
-    t.datetime 'created_at'
-    t.datetime 'updated_at'
-    t.integer 'operating_thetan'
-    t.string 'favorite_color'
-    t.index ['confirmation_token'], name: 'index_users_on_confirmation_token', unique: true
-    t.index ['email'], name: 'index_users_on_email'
-    t.index ['nickname'], name: 'index_users_on_nickname', unique: true
-    t.index ['reset_password_token'], name: 'index_users_on_reset_password_token', unique: true
-    t.index ['uid', 'provider'], name: 'index_users_on_uid_and_provider', unique: true
+  create_table "users", force: :cascade do |t|
+    t.string "email"
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.string "reset_password_redirect_url"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.integer "sign_in_count", default: 0, null: false
+    t.datetime "current_sign_in_at"
+    t.datetime "last_sign_in_at"
+    t.string "current_sign_in_ip"
+    t.string "last_sign_in_ip"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "provider"
+    t.string "uid", default: "", null: false
+    t.text "tokens"
+    t.datetime "created_at"
+    t.datetime "updated_at"
+    t.integer "operating_thetan"
+    t.string "favorite_color"
+    t.index ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true
+    t.index ["email"], name: "index_users_on_email"
+    t.index ["nickname"], name: "index_users_on_nickname", unique: true
+    t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_users_on_uid_and_provider", unique: true
   end
 
 end
diff --git a/test/factories/users.rb b/test/factories/users.rb
new file mode 100644
index 000000000..cf2df768c
--- /dev/null
+++ b/test/factories/users.rb
@@ -0,0 +1,40 @@
+FactoryBot.define do
+  factory :user do
+    email { Faker::Internet.safe_email }
+    password { Faker::Internet.password }
+    provider { 'email' }
+
+    transient do
+      allow_unconfirmed_period { Time.now.utc - Devise.allow_unconfirmed_access_for }
+    end
+
+    trait :with_nickname do
+      nickname { Faker::Internet.username }
+    end
+
+    trait :confirmed do
+      after(:create) { |user| user.confirm }
+    end
+
+    # confirmation period is expired
+    trait :unconfirmed do
+      after(:create) do |user, evaluator|
+        user.update_attribute(:confirmation_sent_at, evaluator.allow_unconfirmed_period - 1.day )
+      end
+    end
+
+    trait :facebook do
+      uid { Faker::Number.number(10) }
+      provider { 'facebook' }
+    end
+
+    trait :locked do
+      after(:create) { |user| user.lock_access! }
+    end
+
+    factory :lockable_user, class: 'LockableUser'
+    factory :mang_user, class: 'Mang'
+    factory :only_email_user, class: 'OnlyEmailUser'
+    factory :scoped_user, class: 'ScopedUser'
+  end
+end
diff --git a/test/fixtures/evil_users.yml b/test/fixtures/evil_users.yml
deleted file mode 100644
index bc84324f1..000000000
--- a/test/fixtures/evil_users.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-confirmed_email_user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  confirmed_at:        '<%= timestamp %>'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @fb_email = Faker::Internet.email %>
-duplicate_email_facebook_user:
-  uid:                 "<%= Faker::Number.number(10) %>"
-  email:               "<%= @fb_email %>"
-  provider:            'facebook'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  confirmed_at:        '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @unconfirmed_email = Faker::Internet.email %>
-unconfirmed_email_user:
-  uid:                 "<%= @unconfirmed_email %>"
-  email:               "<%= @unconfirmed_email %>"
-  provider:            'email'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/lockable_users.yml b/test/fixtures/lockable_users.yml
deleted file mode 100644
index 7a299b32f..000000000
--- a/test/fixtures/lockable_users.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-<% @locked_user = Faker::Internet.email %>
-<% timestamp = DateTime.parse(1.day.ago.to_s).to_time.strftime("%F %T") %>
-unlocked_user:
-  uid:                "<%= @locked_user %>"
-  email:              "<%= @locked_user %>"
-  provider:           'email'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @locked_user = Faker::Internet.email %>
-<% timestamp = DateTime.parse(1.day.ago.to_s).to_time.strftime("%F %T") %>
-locked_user:
-  uid:                "<%= @locked_user %>"
-  email:              "<%= @locked_user %>"
-  provider:           'email'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-  locked_at:          '<%= timestamp %>'
-  failed_attempts:    5
-
diff --git a/test/fixtures/mangs.yml b/test/fixtures/mangs.yml
deleted file mode 100644
index f80e5c83a..000000000
--- a/test/fixtures/mangs.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-confirmed_email_user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  confirmed_at:        '<%= timestamp %>'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= Mang.new.send(:password_digest, 'secret123') %>
-
-<% @fb_email = Faker::Internet.email %>
-duplicate_email_facebook_user:
-  uid:                 "<%= Faker::Number.number(10) %>"
-  email:               "<%= @fb_email %>"
-  provider:            'facebook'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  confirmed_at:        '<%= timestamp %>'
-  encrypted_password:  <%= Mang.new.send(:password_digest, 'secret123') %>
-
-<% @unconfirmed_email = Faker::Internet.email %>
-unconfirmed_email_user:
-  uid:                 "<%= @unconfirmed_email %>"
-  email:               "<%= @unconfirmed_email %>"
-  provider:            'email'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= Mang.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/nice_users.yml b/test/fixtures/nice_users.yml
deleted file mode 100644
index bc84324f1..000000000
--- a/test/fixtures/nice_users.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-confirmed_email_user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  confirmed_at:        '<%= timestamp %>'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @fb_email = Faker::Internet.email %>
-duplicate_email_facebook_user:
-  uid:                 "<%= Faker::Number.number(10) %>"
-  email:               "<%= @fb_email %>"
-  provider:            'facebook'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  confirmed_at:        '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @unconfirmed_email = Faker::Internet.email %>
-unconfirmed_email_user:
-  uid:                 "<%= @unconfirmed_email %>"
-  email:               "<%= @unconfirmed_email %>"
-  provider:            'email'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/only_email_users.yml b/test/fixtures/only_email_users.yml
deleted file mode 100644
index 7c0117bff..000000000
--- a/test/fixtures/only_email_users.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/scoped_users.yml b/test/fixtures/scoped_users.yml
deleted file mode 100644
index cfb26e762..000000000
--- a/test/fixtures/scoped_users.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-confirmed_email_user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  confirmed_at:        '<%= timestamp %>'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/unconfirmable_users.yml b/test/fixtures/unconfirmable_users.yml
deleted file mode 100644
index 7c0117bff..000000000
--- a/test/fixtures/unconfirmable_users.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-user:
-  uid:                 "<%= @email %>"
-  email:               "<%= @email %>"
-  provider:            'email'
-  created_at:          '<%= timestamp %>'
-  updated_at:          '<%= timestamp %>'
-  encrypted_password:  <%= User.new.send(:password_digest, 'secret123') %>
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
deleted file mode 100644
index fa65e199d..000000000
--- a/test/fixtures/users.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-<% timestamp = DateTime.parse(2.weeks.ago.to_s).to_time.strftime("%F %T") %>
-<% @email = Faker::Internet.email %>
-confirmed_email_user:
-  uid:                "<%= @email %>"
-  email:              "<%= @email %>"
-  nickname:           'stimpy'
-  provider:           'email'
-  confirmed_at:       '<%= timestamp %>'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @second_email = Faker::Internet.email %>
-second_confirmed_email_user:
-  uid:                "<%= @second_email %>"
-  email:              "<%= @second_email %>"
-  nickname:           'stimpy2'
-  provider:           'email'
-  confirmed_at:       '<%= timestamp %>'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @fb_email = Faker::Internet.email %>
-duplicate_email_facebook_user:
-  uid:                "<%= Faker::Number.number(10) %>"
-  email:              "<%= @fb_email %>"
-  provider:           'facebook'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  confirmed_at:       '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-
-<% @unconfirmed_email = Faker::Internet.email %>
-unconfirmed_email_user:
-  uid:                "<%= @unconfirmed_email %>"
-  email:              "<%= @unconfirmed_email %>"
-  provider:           'email'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-  confirmation_sent_at: '<%= timestamp %>'
-
-<% @recent_unconfirmed_email = Faker::Internet.email %>
-<% recent_timestamp = DateTime.parse(1.day.ago.to_s).to_time.strftime("%F %T") %>
-recent_unconfirmed_email_user:
-  uid:                "<%= @recent_unconfirmed_email %>"
-  email:              "<%= @recent_unconfirmed_email %>"
-  provider:           'email'
-  created_at:         '<%= timestamp %>'
-  updated_at:         '<%= timestamp %>'
-  encrypted_password: <%= User.new.send(:password_digest, 'secret123') %>
-  confirmation_sent_at: '<%= recent_timestamp %>'
\ No newline at end of file
diff --git a/test/integration/navigation_test.rb b/test/integration/navigation_test.rb
deleted file mode 100644
index 51aed4b7b..000000000
--- a/test/integration/navigation_test.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-require 'test_helper'
-
-class NavigationTest < ActionDispatch::IntegrationTest
-  fixtures :all
-
-  # test "the truth" do
-  #   assert true
-  # end
-end
-
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index e12c2988e..3e115bdd3 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -4,21 +4,16 @@
 
 class UserTest < ActiveSupport::TestCase
   describe User do
-    before do
-      @password    = Faker::Internet.password(10, 20)
-      @email       = Faker::Internet.email
-      @success_url = Faker::Internet.url
-      @resource    = User.new()
-    end
-
     describe 'serialization' do
       test 'hash should not include sensitive info' do
+        @resource = build(:user)
         refute @resource.as_json[:tokens]
       end
     end
 
     describe 'creation' do
       test 'save fails if uid is missing' do
+        @resource = User.new
         @resource.uid = nil
         @resource.save
 
@@ -28,19 +23,14 @@ class UserTest < ActiveSupport::TestCase
 
     describe 'email registration' do
       test 'model should not save if email is blank' do
-        @resource.provider              = 'email'
-        @resource.password              = @password
-        @resource.password_confirmation = @password
+        @resource = build(:user, email: nil)
 
         refute @resource.save
         assert @resource.errors.messages[:email] == [I18n.t('errors.messages.blank')]
       end
 
       test 'model should not save if email is not an email' do
-        @resource.provider              = 'email'
-        @resource.email                 = '@example.com'
-        @resource.password              = @password
-        @resource.password_confirmation = @password
+        @resource = build(:user, email: '@example.com')
 
         refute @resource.save
         assert @resource.errors.messages[:email] == [I18n.t('errors.messages.not_email')]
@@ -49,19 +39,9 @@ class UserTest < ActiveSupport::TestCase
 
     describe 'email uniqueness' do
       test 'model should not save if email is taken' do
-        provider = 'email'
-
-        User.create(
-          email: @email,
-          provider: provider,
-          password: @password,
-          password_confirmation: @password
-        )
-
-        @resource.email                 = @email
-        @resource.provider              = provider
-        @resource.password              = @password
-        @resource.password_confirmation = @password
+        user_attributes = attributes_for(:user)
+        create(:user, user_attributes)
+        @resource = build(:user, user_attributes)
 
         refute @resource.save
         assert @resource.errors.messages[:email] == [I18n.t('errors.messages.taken')]
@@ -71,10 +51,7 @@ class UserTest < ActiveSupport::TestCase
 
     describe 'oauth2 authentication' do
       test 'model should save even if email is blank' do
-        @resource.provider              = 'facebook'
-        @resource.uid                   = 123
-        @resource.password              = @password
-        @resource.password_confirmation = @password
+        @resource = build(:user, :facebook, email: nil)
 
         assert @resource.save
         assert @resource.errors.messages[:email].blank?
@@ -83,9 +60,7 @@ class UserTest < ActiveSupport::TestCase
 
     describe 'token expiry' do
       before do
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
 
         @auth_headers = @resource.create_new_auth_token
 
@@ -103,9 +78,7 @@ class UserTest < ActiveSupport::TestCase
 
     describe 'user specific token lifespan' do
       before do
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
 
         auth_headers = @resource.create_new_auth_token
         @token_global     = auth_headers['access-token']
@@ -137,9 +110,7 @@ def @resource.token_lifespan
 
     describe 'expired tokens are destroyed on save' do
       before do
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
 
         @old_auth_headers = @resource.create_new_auth_token
         @new_auth_headers = @resource.create_new_auth_token
@@ -157,9 +128,7 @@ def @resource.token_lifespan
 
     describe 'nil tokens are handled properly' do
       before do
-        @resource = users(:confirmed_email_user)
-        @resource.skip_confirmation!
-        @resource.save!
+        @resource = create(:user, :confirmed)
       end
 
       test 'tokens can be set to nil' do
diff --git a/test/support/controllers/routes.rb b/test/support/controllers/routes.rb
new file mode 100644
index 000000000..524d215cf
--- /dev/null
+++ b/test/support/controllers/routes.rb
@@ -0,0 +1,43 @@
+class Module
+  include Minitest::Spec::DSL
+end
+
+module ControllerRoutesAfterBlock
+  after do
+    Rails.application.reload_routes!
+  end
+end
+
+module CustomControllersRoutes
+  include ControllerRoutesAfterBlock
+
+  before do
+    Rails.application.routes.draw do
+      mount_devise_token_auth_for 'User', at: 'nice_user_auth', controllers: {
+        registrations: 'custom/registrations',
+        confirmations: 'custom/confirmations',
+        passwords: 'custom/passwords',
+        sessions: 'custom/sessions',
+        token_validations: 'custom/token_validations',
+        omniauth_callbacks: 'custom/omniauth_callbacks'
+      }
+    end
+  end
+end
+
+module OverridesControllersRoutes
+  include ControllerRoutesAfterBlock
+
+  before do
+    Rails.application.routes.draw do
+      mount_devise_token_auth_for 'User', at: 'evil_user_auth', controllers: {
+        confirmations:      'overrides/confirmations',
+        passwords:          'overrides/passwords',
+        omniauth_callbacks: 'overrides/omniauth_callbacks',
+        registrations:      'overrides/registrations',
+        sessions:           'overrides/sessions',
+        token_validations:  'overrides/token_validations'
+      }
+    end
+  end
+end
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 519d80c08..15af6bfd8 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -13,8 +13,10 @@
 require 'minitest/rails'
 require 'mocha/minitest'
 
-ActiveSupport::TestCase.fixture_path = File.expand_path('fixtures', __dir__)
-ActionDispatch::IntegrationTest.fixture_path = File.expand_path('fixtures', __dir__)
+FactoryBot.definition_file_paths = [File.expand_path('factories', __dir__)]
+FactoryBot.find_definitions
+
+Dir[File.join(__dir__, 'support/**', '*.rb')].each { |file| require file }
 
 # I hate the default reporter. Use ProgressReporter instead.
 Minitest::Reporters.use! Minitest::Reporters::ProgressReporter.new
@@ -26,13 +28,9 @@ def follow_all_redirects!
 end
 
 class ActiveSupport::TestCase
-  ActiveRecord::Migration.check_pending!
+  include FactoryBot::Syntax::Methods
 
-  # Setup all fixtures in test/fixtures/*.(yml|csv) for all tests in alphabetical order.
-  #
-  # Note: You'll currently still have to declare fixtures explicitly in integration tests
-  # -- they do not yet inherit this setting
-  fixtures :all
+  ActiveRecord::Migration.check_pending!
 
   # Add more helper methods to be used by all tests here...