fixed _ character in password confirmation