validate password before contacting the server