password validation works