Thank you for the feedback. A month ago, it didn't need any text in the password field at all. I may have overshot the mark a bit when I added validation.
Longer term, I mainly want it to just use external auth (Google, etc.) and not use passwords at all.