add password complexity checking