don't allow password less than 8 characters