make user confirm secret by entering it twice