improved rules for password prompts