let the user choose their own password rather than generating one