new user form uses password input