add password validation and confirmation, +tests