corrected 'is password valid' logic