Fix for #137: check password is >8 chars and contains 1 letter and 1 digit
Security: make sure we can't reset the password when logged in