do password complexity checking in backend

• complexity checking should happen in plugin code not JS

introduce setting for complexity checking:

• option minimum length, default 8
• option complexity: "at least one lower letter case, at least one uppercase letter, at least one special character, at least one digit" -> on/off, default on

first shot:

• tell user that something about password complexity did not work out

(later: fine tune message to exact error)