password confirmation page generates