enforce a minlength on registration pw, fixes #192