client side checks for password policy, fix #22

this fixes #22