password/passphrase strength checking and enforcement