#25 - more lenient passwords, longer max length