add config settings for min/max password length; set to 1/100