[cbk1994]

Would really like to see passwords be changable by users, but it should not cost gelats—that's just ridiculous.

Also, password strength requirements are annoying. As long as it's eight characters or so, let a user be responsible for their own account. Worrying about hackers getting passwords from the hashes is not really an issue unless the passwords database is stolen, at which time Graal should force a password reset for all users anyway.