fix: password validation

Password validation done only on create.