[sign-up] check password strength at both client and server side