Fixes to password policy