Respect values of auth.password_min_length below 8 (issue #749)

No comment on how valid a choice it is.  Still, password strength is
supposed to be centralised in valid_password().  And if Bonfire wants to
restrict the allowed setting, we need to say so on the settings page.
Not silently ignore the user setting :).