Improving password field validation

Now takes into account _confirm path
Allowing direct setting of password fields without auto hash