introduce configurable password enforcement policy, set to complain by default; password policy is "should", not "must" (closes bug #0003421)