Warn user if they try to use a weak password

[cadecairos]

We check new passwords users set against a list of the 10,000 most commonly used passwords, and reject any that appear on it. We don't, however, display a meaningful message about rejected passwords, which we should.