crude checks on password scheme quality