Fix permitted parameters in users controller

Password and password confirmation are both permitted, and required to
create a new user.

Closes #722