Add password advice: see #1959