FIX: handle password length requirement error from API