confirm password, not email
cleanup, remove extractUser