Hide the password field on the admin user creation form, instead generating the value.
Hide the password field on user edit form for admins, replacing it with a "Generate a secure password" checkbox that will generate a new password for the user if an admin checks the box.
Passwords should be "strong" by multiple measures, i.e. always contain at least 1 upper alpha, at least 1 lower alpha, at least 1 "special" char, at least 1 number, at least 10 more characters chosen randomly from among the superset of all of those.
Limited config. It's on or off.
Todo:
At least some tests
README about the 1 config item
Handle entering passwords on registration page (disable "require email verification when a visitor creates an account")