add User#password validations