Did you agree with client that password should have 6-40 chars?