a bit more work on password policy and feedback