Verifying that the password boxes match belongs in the client (so the website, in this case) because we don'\t want to enforce the duplicate password UI decision in the API.

We're validating that the fields are required in the client, but we're doing that because that's the way that we know to add e.g. aria-required attrs to the fields which again, is a UI concern that's specific to this client (the frontend profile website).