There is no need to white-list password_confirmaton since you are doing `has_secure_password validations: false` in the model.