limit user password length