added a note to password validation