Why you shouldn't let your password 'play the field'