No Default Password Policy in Effect

[StephenCote]

No default password policy or reset confirmation are in effect.

1. When changing a password, the current password is not required for the current user to confirm they know the current password. However, resetting a password to blank indicates success, but does not actually change the value (apparently), and the previous password is still in effect.
2. No password policy or strength rule is in effect. Blank and single character passwords are allowed.

[jrogelstad]

This form is not meant for users to change their own password, but for people with administrator access to change passwords for other users, so we can't ask the person editing to enter the old password. See comment on issue #39 suggesting by default nobody except super users get granted access to admin and develop objects and workbooks. See issue #12 still open to provide a way for users to change their own password which would require entering the current one.

Regarding the blank password behavior, both with regards to a blank not doing anything and the allowing of a blank password for a new user, this is identical to postgres default behavior in pgAdmin. I think also falls in the category of something better handled in a commercial version that uses a third party service for authentication where we can get all kinds of fancy stuff like 2 factor authentication, complexity rules, time limits etc. Don't think it makes sense to re-invent any of that within this app.