add password confirmation, all tests pass