Improve user password validation

- Makes min length configurable
- Length wasn't verified when changing password