added password length restriction