validate password on update