update user now checks for password length before hashing it;