Weak password can be entered on reset password screen

[rmccue]

Steps to reproduce:

1. Request a password reset
2. Follow the link to the password reset screen
3. Enter a weak password to change to
4. Inspect the button and re-enable it
5. Submit the weak password and observe it gets updated

This should be properly blocked on the backend, to match the behaviour of the user profile screen, not just in client-side JS/CSS.

This should have been fixed in #152 but looks like we didn't actually check on the backend.

Acceptance criteria:

• ...