Add password length checks to JUser, JUserHelper and JCryptPasswordSimple to prevent use of strong encryption for DOS. Thanks David Jardin.