Add password complexity requirements

[jturnbull]

Security requirements of a number of projects require the site to enforce a set of complexity for passwords. Usually this is some of the following:

• mixture of upper and lowercase letters
• at least one number
• at least one "special character"

[meshy]

How is this to work on websites that are targeted at people that do not use the roman alphabet?

[jturnbull]

Good point. It seems that international corporate password standards, even those which are written in asia, only talk in terms of ASCII.

This stackoverflow answer hints that UTF-8 could be a support headache (normalising UTF-8 sounds painful).