add PIN length checks