validate password length