password must meet complexity requirements