Min password length should be configurable, not hard-coded.