Password must have eight characters.
Don't send validation strings to the client.