fixes on password scoring