#253, do not send password_control to api and make sure the form is not submitted when the passwords do not match