Allow changing the global_xss_filtering config setting to false

This assumed that global_xss_filtering is turned off. Firstly we do
a password check for the password. If it fails, we then run the
xss_clean() method on the password and try again. If this then
succeeds, we update the password in the database so that it's
we don't need to do this again.
Merge branch 'akrabat-password-fixer'