Move password validator from pre save middleware to actual validation