password inputs should reflect errors too