Support for custom password rules via `clean_password` (closes #599)