fix: also permit password confirmation (would be striped otherwise)