I think we had considered doing that, but weren't sure how to check if password2 was equal to their newly updated encrypted_password field.