Don't let client submit too-short passwords. Fixes #442.