passwords most be >=8 chars and not in list of 10K most common (closes #34)
conflict fixes