enforce rules on passwords