password - atleast have 2 special char