minimal user profiles, password validation bug