Account lockout enforcement and min lengh reqs