i'd prefer no password validation other than having to type it twice. but have a password strength gauge, and give hints on how to bump up the strength (have you tried using a non-alphanumeric character)