mask pw and ask for verification during setup

[paulparkinson]

Usually pw entries are masked with "*" when entered and user is asked to enter them again to verify. We don't do either and so it's fairly easy for user to mistype and not know there pw for use later.