validate: fix "Password" check to be consistent with server