password confirmation machinery implemented with the has_secure_password tag
fixed some tests