fixed password validation