validate password + specs