Validate password length client-side