added password length requirement