Centralise the password length check

The password length check moves into `update_password` and the login flow, so every password write goes through it.