what is the default minimum length in characters of a user password, and where is the minimum password length defined?