Externalize policy code via a global 'policy' object

The policy is modified by calling policy.addPolicyFn, which takes a
function whose only argument is the element to be checked by the
policy.

The old, hard-coded password policy is left intact so that the
password example is still runnable in this commit.
password: Convert to externalized policy API