only verify password length on create, otherwise we can never modify account as a password column doesnt exist