This should probably check just the length of `password`, not also `confirm_password`.