fix confirm password is prefix of password