added minimum password length validation