fix password validation, make signal logic clearer