DRY. Password validation should be moved to an external function, as it is used in 3 places already (user create, user update, forgot password)