password now validated on both user signup and password reset