adjust api spec for password confirmation