Add optional regex to enforce password complexity

As discussed, with a minor change: instead of adding an additional parameter for the regex, I made the third parameter generic (pass_req) and run password validation based on type.  This keeps things backwards-compatible without cluttering up the method call.

* if pass_req is a string, assume it's a regex and test the password against that;
* if above fails with a TypeError, pass_req is an integer so we test for password length only;

Also as discussed, I set the default password requirement to minimum length 6.