check password length