correct password validation