moved password validation to one place
update tests