should not default confirm pw