We use `build_stubbed` so that the user associations have IDs because in
the policy, we do some ID comparison to determine if the user is the
owner of the token.

We had to use `create` for the blocked user case because the factory
calls `User#block!` which saves the update to the DB and that does not
work with stubbed models.