fix password validation