I have a password field in setup.xml which provides a second confirmation field. However, the confirmation is requested also if the password field has not been touched. This means I always have to enter the password even if I just changed other fields.
My end-point is a custom conf file and my entity is an existing one. I'm running 6.4.1. If I change just the user id, and don't fill in the confirm password field (the password field itself is obviously populated) I get an error the the fields don't match.