add spec and code for validation error if password confirmation is blank