another bug on password validator