fixed a bug in password policy enforcement

did not test for appropriate actor meta data

closes #134