require new user to type their password twice

Fixes #212