add min. length client-side validation to password on user create