add spec and code for validation error if password is blank