Michal Šmahel
74915f6840
Strict password validation is for registration, change password, reset password and similar forms. In login form, we don't want to interrupt user with unnecessary validation as it's completely irrelevant what they actually entered. The one thing it's about is the correctness of the email and the password. Disabling strict validation for password is a kind of security through obscurity, which could filter some untargeted attempts for trying passwords by bots. If the bot immediatelly receives notes about the requirements, it has more imformation for better attacks.