removed password length validation from user feature spec