25656 password policy again

Reroll of existing PR against HEAD, with fix for tests.