[adamb_]

Usually form validation occurs on the server-side, written such that if a form's post body is invalid, a human-readable set of errors will be returned to the client to display. In this context, the password is just another field mapped to a specific conditional check -- which, if evaluated as false, simply means adding a canned message to the said set of errors to return.