update password length requirement