Common Sense Means Rethinking NIST Password Rules