Unify score for too short passwords

It's 6 in the ruby class so it makes sense to follow the same rules in js.