I guess SignupForm's clean method should invoke validate_password from django.contrib.auth.password_validation