Application Specific password requirements not included in validation in PasswordResetHandler #101
Description
BasicSecurity.constructPasswordRequirements expects that it will be overwritten by applications in their extension of it. These requirements are enforced when calling BasicSecurity.passwordChange. However, in PasswordResetHandler.authorize the input is validated through getPasswordResetValidatorSet() process, which doesn't consider the application specific requirements. PasswordResetHandler.authorize allows those passwords that pass the default validation but would fail the application specific ones to make it past the validation step, but when it comes time to actually save, the password will fail. There is no failure indicated back to the caller here, so the user believes they have updated their password when they haven't.