[1.x] Improve SPA compatibility

[y0rdie]

Just some very minor changes to make the package more SPA compatible out the box:

1. Be explicit with the authentication guard otherwise a SPA will attempt to use the RequestGuard and fail.
2. Throw a ValidationException if the confirmed password is invalid.

There's of course many ways to implement both points, I've gone with the least amount of change, however:

1. We could type hint the StatefulGuard in the constructor like Fortify's AuthenticatedSessionController and ConfirmablePasswordController.
2. We could wrap the exception in an if ($request->wantsJson()) { conditional and keep the back() redirect for server rendered apps, again like Fortify's FailedPasswordConfirmationResponse.

Happy to change this request to your preferred implementation if acceptable.

Thanks for your time,
Sam

[y0rdie]

Sweet thanks ☺️