Password strength enforcement should be configurable (low, medium, high)

Server-side password strength enforcement should be configurable to enforce the various levels of strength, or not enforce at all.