main
specs: api moved into specs
specs: add null-value update tests for bio/image, reject null/empty username/email
specs: api tests for PUT /user password policy (NIST 800-63B) — refs #1708