Add server-side validation to password changes