The "all users must authenticate themselves via password" statement has some tension with the example given, which constrains the password requirement to 127.0.0.1/32. Perhaps "all users must authenticate themselves from localhost via password" (or something less awkward).