fix password length validation