Not exclusive to this PR but I have noticed it before: I think these should be the opposite (`options.merge(:api_function => 'get_password_strength')`), otherwise a caller is able to override it (`.strength(:api_function => 'hahaha')`).