Improved password policy

Require a bit longer passwords
Forbid people to use very bad passwords

We decided not to require very complex rules though, as that often
impedes usability