security improvement
length of password must be in the range of [6, 20]
fix bug: password cache not updated