add set password validation

[jgangemi]

it would be great if the the set-password directive could allow two password input fields and validate that the passwords are the same and maybe allow for a callback to perform more advanced validations.