password_confirmation requires distinct logic