final form validation: locked questions require a password