enforce min password length on both FacilityUser.set_password and FacilityUserForm