UX feature: heads-up for new users about minimum password length 

I think that changing these options will affect the `devise_for` call from the application `routes.rb` and might break some configuration of existing apps. Maybe we should leave it as is (for now) or emit some kind of warning for the new API.