added first user spec for password validation