Move the password confirmation form template to post

I know we use JS for this. But it triggers some false positives on
testing.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>