move password policy pattern to PasswordService