Fix: throw exception when password and confirmation don't match