Encrypted repo: Password length not enforced on server side

[egroeper]

REPO_PASSWORD_MIN_LENGTH is not enforced on server side, but only checked by JS code.
That way you can easily bypass the check by sending a HTTP request directly.

We found this, when we investigated another bug, that was reported to us:
If you select the "encrypt" checkbox and choose a weak password, you get a warning message about the password length. If you then uncheck the "encrypt" checkbox and hit "Submit" the library gets created with the weak password.

Steps to reproduce weak password library creation:

• "New library"
• enter name, select "encrypt", enter weak password (i.e. "test")
• hit "Submit"
• uncheck "encrypt" checkbox
• hit "Submit" again

In my opinion the correct solution for this is to enforce the password length on the server side, too!
And you should only care about the entered passwords, if the encryption checkbox is checked.