Allow changing the global_xss_filtering config setting to false

This assumed that global_xss_filtering is turned off. Firstly we do
a password check for the password. If it fails, we then run the
xss_clean() method on the password and try again. If this then
succeeds, we update the password in the database so that it's
we don't need to do this again.
Add note about the site being in maintenance mode
Add bold text
Merge pull request #819 from mgdm/patch-1

Add note about the site being in maintenance mode
Merge branch 'akrabat-password-fixer'