include Password policy into register user and change password; fix user avatar with and height