Would it make sense to add `validate="password"` here? We use this in the other user forms.