only passwordConfirm needs to match password, this gives a nicer error message