As a side note, if you are a website with arbitrary rules, as a general UI recommendation, please state your rules if a user inputs an incorrect password. I'm looking at you yahoo.