Pluggable password validation