validates user.password