I feel pretty dumb, sure enough it's right there. Pardon my error I glanced right past that. Positioning the text with the password field would likely help, and/or include all rules in the error message, not just the one that's violated.