no issue
- PasswordValidator was only adding a function to the base class but it introduced a confusing inheritance hierarchy that's easier to reason about when it's a mixin instead
- swapped the `this.properties =` and `this._super()` calls in the `init` function of `new-user` so that the default can actually be applied
- previously the BaseValidator `init` method was doing `this.properties = []` which meant the default fallback in extended classes wouldn't work