User password changes for resetting a known password or resetting a forgotten password are now validated after the user enters their password and then clicks the button to change or reset it. Passwords are no longer evaluated at runtime. See Password Policy Validation.