client side checks for password policy, fix #22