Do password requirements such as "you must have at least one letter, one number, and one symbol" actually significant enhance password strength?