BUGFIX: new password needs to be at least 4 characters long