If the passwords don't match, the form is refreshed with
all the input fields blank -- i.e., new user isn't in the user
database yet. It would be nice if all the data in the non-
password fields were preserved, or if the password
mismatch could be caught earlier (e.g., via javascript in
the form submit).