Add tests and find other incorrect uses of :user instead of resource_name

[tcannonfodder]

In 5ef8c83, we found code that used :user instead of resource_name. This would cause issues when implementing passkey controllers for non-user resources.

We need to:

• Check the rest of the codebase for any additional uses of :user that should be resource_name
• Write tests to prevent regressions, since there do not appear to be any