Password confirmation

the token probably doesn't have to be that long