make user pick password