Don’t raise an exception for too short passwords, fail with a validation error instead.