Many websites have harsh requirements for password format. I suggest that you relax the rules as much as possible. Obviously, a system for trading millions of dollars must be more secure than one that lets people read the daily news. If your rules are too strict, many users will not be able to use names and passwords that make sense to them. This increases the likelihood of users forgetting their login information the next time they visit.
Nobody wants to log in again and again.
Ideally, the system is the users' total experience and thus they should only have to identify themselves to the computer once. The fact that they are actually browsing multiple websites should not be the users' problem. Indeed, in the future, personal computers will probably become truly personal and serve as users' agents in cyberspace, including taking over responsibility for passwords and identification. Logout For sensitive systems, many users feel more comfortable when they see an explicit logout button. For most systems, however, you can assume that users will not log out and instead will simply leave.