Password must contain at least 6 characters and one uppercase letter.

As the password is stored as a hash in a database, I added validation before the user is created.
To quote a relevant section from the controller:

```
try:
    if request.session.model('res.users').change_password(
        old_password, new_password):
        return {'new_password':new_password}
except Exception:
    return {'error': _('The old password you provided is incorrect, your password was not changed.'), 'title': _('Change Password')}
```

Yep. Odoo is catching all exceptions. Cleaver (/s). Julia told me about this before, and I advised her to add a task for overriding and fixing the controller, but otherwise leave it for now.