ensure password confirmations do not appear in logs