user must confirm password and cannot log in with the wrong password