changed user controller to include confirm password and include flash