Remove confirmedPassword from payload, to be handled by client.