add validation to changing password