must contain ONLY digit and lowercase. Previous implementation only checked that it contained at least one of each.
Do this by interating through each character in the password and ensuring it is valid.
Add a test case to make sure password with uppercase and lowercase letters is invalid.