Just realized I never committed proper validation of passwords. Now it’s there.