validates length of passwd