Added minimum_length flag to password policy to prevent abuse.