javascript password validation fixed