clarified password policy