add minimum length validation for password