add spec and code for validation error if passwords do not match