model: non-empty user.password
model: match user.password to its confirmation