Signup form accepts invalid passwords with no error message

Passwords are sanitized down to alnum but no message is shown to the user if they put non-alnum characters into the "password" fields on the signup form. This can require the new user to reset their password before logging in.