Now min password len isn't hard coded