add password strength validation