add user validation for matched passwords spec