new user page has password fields