A standard for describing a site's password rules