Extend validation to other forms

[jonasraoni]

mustChangePassword

If the user has the flag mustChangePassword, then the lock mechanism is ignored in this form, maybe it should be enabled?!

Administration

When creating a new user, the password security isn't enforced on the password field. Perhaps it's ok, so I'm just leaving a note.

[ctgraham]

I bet we will have administrators with differing opinions on enforcing password requirements from the user administration form. I personally lean toward the position that requirements should be enforced or password changed should be required at next login.

Which form is ignoring the lock mechanism? If it is the password reset form, this is intentional. A password reset unlocks the user after bad password attempts.

[jonasraoni]

The issue about the mustChangePassword was just a bad test from my part, ignore :)