We already other means to do that, allowing more visibility to caller *why*
a password may be rejected.