validates passwords