BUGFIX should add password_confirmation as well as password to filter parameters