Enforce password policy

This patch allows you to enforce a password strength policy. It gives you a config variable `$password_policy` which can be set to false (the default) or to [something PHP considers to be callable](http://www.php.net/manual/en/language.types.callable.php) (such as the name of a function, or a class/method pair, or a closure, or whatever). This callable thing should return true if the password is OK, and false otherwise.

A demonstration function is included, which does the following check:

* password is bad if length < 8
* password is ok if length >= 16
* otherwise the password is only ok if it contains at least three of the following:
  * an upper-case character
  * a lower-case character
  * a number
  * a non-alphanumeric character