fix: confirm password is unset when != password