Check out these changes:

https://github.com/serac/cas/commit/78ea2bd2c7557302f29328d10d4466b660b1e9bc

I believe the result was faithful to your recommendation, but I painted broader as usual. I think these changes position us well to grow password policy into other handlers.