users now get classified as confirmed if they have a password set.