add minimum password length, fixed up form validation