include a configurable password policy enforcement in gui; update test to conform to default policy as well