improved confirm

- uses the prompt() validation instead of looping
- allows response to be stored in env
- better semantic usage of the default keyword arg