Allow changing the global_xss_filtering config setting to false

This assumed that global_xss_filtering is turned off. Firstly we do
a password check for the password. If it fails, we then run the
xss_clean() method on the password and try again. If this then
succeeds, we update the password in the database so that it's
we don't need to do this again.