spec for longer password option (needs to be fixed to work with new implementation)