cd7a5f7 said length rules now apply only to new passwords, but its edit never matched, so every password input still carried minLength and maxLength and a password set under older rules was refused in change-password. The attributes go: usePasswordValidator already enforces the length on every new-password field.