Infosec requirements can change widely from company to company. My current client requires that there be no character repeating more than twice, the screen name not be part of the password, and a few other intricacies that we currently don't support. To fix this Password policies should be hookable. That way a client can make a 100% custom password policy via a hook plugin.