Make sure that negative password lengths are clamped to 0.