Enforcing password restrictions