testing for password length