fixes #3725, #4167 - root password validations