Only validate password on create