to prevent brute forcing of weak postgres passwords, we already have fairly strict password requirements but this would be a strong addition