clarify password requirements