put back password validations, now only run on creation of user. This may not be as safe.