password length validation

Universal. Should be triggered on password update as well. Not only when
creation initial user object.