fixed #12: backspace or delete doesn't invalidate password