validate length of password