removed password_confirmation from strong_parameters whitelist