Add validation of password length to the user-create plugin.

Ideally this type of validation would be done somewhere in the model.
Currently our use of the set_or_return method doesn't easily allow for
these types of validations.