Allow avatar. Add password confirmation.