realistic password strength estimation (for node.js)