DefaultPasswordValidator in security-config