confirm password when reset password
since flask-wtf has not merged my pr, let's make it a built-in