moved validation for password from editProfile to user model