don't log passwords of insufficient strength

src/metabase/api/common.clj

@@ -375,7 +375,8 @@
 (defannotation ComplexPassword
   "Param must be a complex password (*what does this mean?*)"
   [symb value]
-  (checkp-with password/is-complex? symb value "Insufficient password strength"))
+  (check (password/is-complex? value)
+    [400 (format "Invalid value for '%s': Insufficient password strength" symb)]))
 
 (defannotation FilterOptionAllOrMine
   "Param must be either `all` or `mine`."

test/metabase/api/setup_test.clj

@@ -56,7 +56,7 @@
                                        :email "anything"
                                        :password "anything"}))
 
-(expect "Invalid value 'anything' for 'password': Insufficient password strength"
+(expect "Invalid value for 'password': Insufficient password strength"
   (http/client :post 400 "setup/user" {:token "anything"
                                        :first_name "anything"
                                        :last_name "anything"