More password strength enforcement

Adds password strength checking to the account recovery and normal
password change flows. Really this should be refactored to not have this
check repeated three times.