added minimum password length requirement in User model