add validation to User to accept pw confirmation