Add the extra password check to beforeCreate as well