I would use `getattr` on `PASSWORD_CONSTRAINTS` to allow it to be overridden; I would also do a `getattr` on `PASSWORD_MIN_LENGTH` that defaults to 6, to allow a simple shortcut for end-users in setting this.