improvements for password view

- password strength was one character behind input
- reset password strength when second password does not match
- enforce reasonable password strength