fixed off by one error on password length