update password rules