added length constraint to password changes