Enforce same rules for password changing

Make sure changing password and password reset follow Oscar's password conventions