Add a comment about password validation rules