handle 3–20 chars, a–z 0–9 _

password at least 8 chars

confirm password