model: limit user.password minimal length