fixed attr_accessible so user can create password and confirm