throw error message on password too short