Update User.php

Again, fixed username, password minimum, maximum lengths and messages