Stop forcing arbitrary password rules