fixed password rule bugs