update password policy