made require_login private; added passwords_match? method (commented out)