Password policy not enforced on creation of users

I'm working on a patch.

Sponsored by British Council.

I've run out of time to work on this. Sorry.

At first I thought it would be simple to implement with password_policy_form_user_register_form_alter()

However due to the way the validation is done for the user/$/edit page
$account = $form['#user'];
It uses the user info that was there before the form was rendered. This could also cause issues if you were to have different password policies for different roles and change the role(s) at the same time as changing the password.

Then there is a lot of chasing around to work out whats actually using something from that array $account, which after the best part of a day I still hadn't completely got through it.

This is what I added to password_policy.module it obviously doesn't work but thought I'd put it here to help with the fixing of this.

function password_policy_form_user_register_form_alter(&$form, $form_state) {
  password_policy_password_element_alter($form['account']['pass'], $form['#user']);
  $form['#validate'][] = 'password_policy_user_register_form_validate';
  $form['#submit'][] = 'password_policy_password_submit';
}

function password_policy_user_register_form_validate($form, &$form_state) {
  if (!empty($form_state['values']['pass'])) {
    $account = array(
        'roles' => $form_state['values']['roles'],
        'name'  => $form_state['values']['name']
    ); // This is a pain, what can I pass through here?
    $policies = PasswordPolicy::matched_policies($account);
    $errors = array();
    foreach ($policies as $policy) {
      $errors = $errors + $policy->constraint($form_state['values']['pass'], $account);
    }
    if (!empty($errors)) {
      form_set_error('pass', theme('item_list', array('items' => $errors)));
    }
  }
}