issue #20563: relax password length requirements