1. validation
2. update password