add password constraint to 4 characters