Added a stat for referenced password

They're now excluded for length statistics
Referenced password follows {REF: } pattern