further password validations on models