password constraint changed in api and model