Use a single form for user create and modify

While I'm here make password confirmation optional for the API.