validates password length