password must be set during creation, validate correctly