validate password at client side