Advise users of their password strength during sign-up and password change

[eoinkelly]

Integrating something like https://github.com/indirect/unpwn to show some sort of traffic-light alike advice on password strength seems good. I suggest we keep this separate from our password requirements (which the user should be informed of up-front). The goal of this feature would be to encourage them to make better passwords.

[robotdana]

how might this work in terms of guidance vs validation, does it require js?

[lukeify]

Anyone picking this up should be also aware of #479