password validation fixed