hide and validate passwords