diff --git a/.travis.yml b/.travis.yml
index 1f182ae..0e1cc4e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -19,7 +19,8 @@ matrix:
     - env: TOX_ENV=py34-djangopre
 install:
   - psql -c 'CREATE DATABASE user_management' -U postgres;
-  - pip install tox!=1.9.1 coveralls
+  - pip install -U pip
+  - pip install tox==1.9.0 coveralls
 script:
   - tox -e $TOX_ENV
 after_success:
diff --git a/user_management/api/avatar/tests/test_views.py b/user_management/api/avatar/tests/test_views.py
index 517f03c..507c4d4 100644
--- a/user_management/api/avatar/tests/test_views.py
+++ b/user_management/api/avatar/tests/test_views.py
@@ -17,7 +17,7 @@
 TEST_SERVER = 'http://testserver'
 
 
-def _simple_png():
+def simple_png():
     """Create a 1x1 black png in memory."""
     image_file = BytesIO()
     image = Image.new('RGBA', (1, 1))
@@ -30,23 +30,19 @@ def _simple_png():
     )
     image_file.seek(0)
     return image_file
-SIMPLE_PNG = _simple_png()
 
 
 class TestProfileAvatar(APIRequestTestCase):
     view_class = views.ProfileAvatar
 
-    def tearDown(self):
-        SIMPLE_PNG.seek(0)
-
     def test_get(self):
-        user = UserFactory.build(avatar=SIMPLE_PNG)
+        user = UserFactory.build(avatar=simple_png())
 
         request = self.create_request(user=user)
         view = self.view_class.as_view()
         response = view(request)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data['avatar'], SIMPLE_PNG.url)
+        self.assertEqual(response.data['avatar'], simple_png().url)
 
     def test_get_no_avatar(self):
         user = UserFactory.build()
@@ -64,7 +60,7 @@ def test_unauthenticated_put(self):
         The view should respond with a 401 response, confirming the user
         is unauthorised to put to the view.
         """
-        data = {'avatar': SIMPLE_PNG}
+        data = {'avatar': simple_png()}
         request = APIRequestFactory().put('/', data=data)
         view = self.view_class.as_view()
         response = view(request)
@@ -73,7 +69,7 @@ def test_unauthenticated_put(self):
 
     def test_authenticated_put(self):
         user = UserFactory.create()
-        data = {'avatar': SIMPLE_PNG}
+        data = {'avatar': simple_png()}
 
         request = APIRequestFactory().put('/', data=data)
         request.user = user
@@ -84,9 +80,8 @@ def test_authenticated_put(self):
             mocked_url.return_value = 'mocked-url'
             response = view(request)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
-        SIMPLE_PNG.seek(0)
         user = User.objects.get(pk=user.pk)
-        self.assertEqual(user.avatar.read(), SIMPLE_PNG.read())
+        self.assertEqual(user.avatar.read(), simple_png().read())
 
     def test_options(self):
         request = self.create_request('options')
@@ -95,7 +90,7 @@ def test_options(self):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
 
     def test_get_resize(self):
-        user = UserFactory.build(avatar=SIMPLE_PNG)
+        user = UserFactory.build(avatar=simple_png())
 
         data = {
             'width': 10,
@@ -111,7 +106,7 @@ def test_get_resize(self):
         self.assertNotEqual(response.data['avatar'], expected_url)
 
     def test_get_resize_width(self):
-        user = UserFactory.build(avatar=SIMPLE_PNG)
+        user = UserFactory.build(avatar=simple_png())
 
         data = {
             'width': 10,
@@ -126,7 +121,7 @@ def test_get_resize_width(self):
         self.assertNotEqual(response.data['avatar'], expected_url)
 
     def test_get_resize_height(self):
-        user = UserFactory.build(avatar=SIMPLE_PNG)
+        user = UserFactory.build(avatar=simple_png())
 
         data = {
             'height': 10,
@@ -149,7 +144,7 @@ def test_delete_without_avatar(self):
         self.assertEqual(response.status_code, status.HTTP_204_NO_CONTENT)
 
     def test_delete_with_avatar(self):
-        user = UserFactory.create(avatar=SIMPLE_PNG)
+        user = UserFactory.create(avatar=simple_png())
         request = self.create_request('delete', user=user)
         view = self.view_class.as_view()
         response = view(request)
@@ -171,7 +166,7 @@ def test_send_without_token_header(self):
         user = UserFactory.create()
         token = AuthTokenFactory(user=user)
 
-        data = {'avatar': SIMPLE_PNG, 'token': token.key}
+        data = {'avatar': simple_png(), 'token': token.key}
         url = reverse('user_management_api:profile_avatar')
         response = client.post(url, data=data)
 
@@ -185,10 +180,7 @@ class TestUserAvatar(APIRequestTestCase):
 
     def setUp(self):
         self.user = UserFactory.build()
-        self.other_user = UserFactory.build(avatar=SIMPLE_PNG)
-
-    def tearDown(self):
-        SIMPLE_PNG.seek(0)
+        self.other_user = UserFactory.build(avatar=simple_png())
 
     def get_response(self, request):
         """
@@ -240,7 +232,7 @@ def test_get(self):
         request = self.create_request(user=self.user)
         response = self.get_response(request)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertEqual(response.data['avatar'], SIMPLE_PNG.url)
+        self.assertEqual(response.data['avatar'], simple_png().url)
 
     def test_get_no_avatar(self):
         self.other_user.avatar = None
@@ -289,7 +281,7 @@ def test_get_resize_height(self):
     def test_put(self):
         user = UserFactory.build(is_staff=True)
         other_user = UserFactory.create()
-        data = {'avatar': SIMPLE_PNG}
+        data = {'avatar': simple_png()}
 
         request = APIRequestFactory().put('/', data=data)
         request.user = user
@@ -300,14 +292,13 @@ def test_put(self):
             mocked_url.return_value = 'mocked-url'
             response = view(request, pk=other_user.pk)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
-        SIMPLE_PNG.seek(0)
         user = User.objects.get(pk=other_user.pk)
-        self.assertEqual(user.avatar.read(), SIMPLE_PNG.read())
+        self.assertEqual(user.avatar.read(), simple_png().read())
 
     def test_patch(self):
         user = UserFactory.build(is_staff=True)
         other_user = UserFactory.create()
-        data = {'avatar': SIMPLE_PNG}
+        data = {'avatar': simple_png()}
 
         request = APIRequestFactory().patch('/', data=data)
         request.user = user
@@ -318,9 +309,8 @@ def test_patch(self):
             mocked_url.return_value = 'mocked-url'
             response = view(request, pk=other_user.pk)
         self.assertEqual(response.status_code, status.HTTP_200_OK)
-        SIMPLE_PNG.seek(0)
         user = User.objects.get(pk=other_user.pk)
-        self.assertEqual(user.avatar.read(), SIMPLE_PNG.read())
+        self.assertEqual(user.avatar.read(), simple_png().read())
 
     def test_send_without_token_header(self):
         """Test support for legacy browsers that cannot support AJAX uploads.
@@ -334,7 +324,7 @@ def test_send_without_token_header(self):
         user = UserFactory.create(is_staff=True)
         token = AuthTokenFactory(user=user)
 
-        data = {'avatar': SIMPLE_PNG, 'token': token.key}
+        data = {'avatar': simple_png(), 'token': token.key}
         url_kwargs = {'pk': user.pk}
         url = reverse('user_management_api:user_avatar', kwargs=url_kwargs)
         response = client.post(url, data=data)
diff --git a/user_management/api/serializers.py b/user_management/api/serializers.py
index 10858e2..d52108b 100644
--- a/user_management/api/serializers.py
+++ b/user_management/api/serializers.py
@@ -51,7 +51,7 @@ def validate(self, attrs):
         password2 = attrs.pop('password2')
         if password2 != attrs.get('password'):
             msg = _('Your passwords do not match.')
-            raise serializers.ValidationError(msg)
+            raise serializers.ValidationError({'password2': msg})
         return attrs
 
     def restore_object(self, attrs, instance=None):
@@ -97,16 +97,13 @@ def validate_old_password(self, attrs, source):
             raise serializers.ValidationError(msg)
         return attrs
 
-    def validate_new_password2(self, attrs, source):
-        if attrs.get('new_password') != attrs[source]:
-            msg = _('Your new passwords do not match.')
-            raise serializers.ValidationError(msg)
-        return attrs
-
     def validate(self, attrs):
         if attrs.get('old_password') == attrs.get('new_password'):
             msg = _('Your new password must not be the same as your old password.')
             raise serializers.ValidationError({'new_password': msg})
+        if attrs.get('new_password') != attrs['new_password2']:
+            msg = _('Your new passwords do not match.')
+            raise serializers.ValidationError({'new_password2': msg})
         return attrs
 
 
@@ -135,10 +132,10 @@ def restore_object(self, attrs, instance=None):
         instance.set_password(attrs['new_password'])
         return instance
 
-    def validate_new_password2(self, attrs, source):
-        if attrs.get('new_password') != attrs[source]:
+    def validate(self, attrs):
+        if attrs.get('new_password') != attrs['new_password2']:
             msg = _('Your new passwords do not match.')
-            raise serializers.ValidationError(msg)
+            raise serializers.ValidationError({'new_password2': msg})
         return attrs
 
 
diff --git a/user_management/api/tests/test_serializers.py b/user_management/api/tests/test_serializers.py
index 01ae0a6..1216e48 100644
--- a/user_management/api/tests/test_serializers.py
+++ b/user_management/api/tests/test_serializers.py
@@ -179,7 +179,7 @@ def test_deserialize_mismatched_passwords(self):
         serializer = serializers.RegistrationSerializer(data=self.data)
         self.assertFalse(serializer.is_valid())
         message = 'Your passwords do not match.'
-        self.assertIn(message, serializer.errors['non_field_errors'])
+        self.assertIn(message, serializer.errors['password2'])
 
     def test_deserialize_no_email(self):
         self.data['email'] = None
diff --git a/user_management/api/tests/test_views.py b/user_management/api/tests/test_views.py
index ac3fda8..b84a0b1 100644
--- a/user_management/api/tests/test_views.py
+++ b/user_management/api/tests/test_views.py
@@ -238,7 +238,7 @@ def test_post_password_mismatch(self):
         request = self.create_request('post', auth=False, data=self.data)
         response = self.view_class.as_view()(request)
         self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
-        self.assertIn('Your passwords do not match.', response.data['non_field_errors'])
+        self.assertIn('Your passwords do not match.', response.data['password2'])
 
         self.assertFalse(User.objects.count())