Move password validation to model.