Added test: user must have a password and confirmation on create