add min password length and unittests