It seems odd to me that this is the only edge case poorly handled by the server: only too-short passwords, not too-long passwords, or passwords with illegal chars. Is it possible that the better fix is to harden the server?

OTOH, if we want to be considerate users of our own server APIs, is it possible that the better fix is to validate all passwords site-wide using some common front-end util?