enforce password at least 16 chars

add comment re uiHost so user knows what we are doing

lib/commands/init/index.js

@@ -105,10 +105,10 @@ async function promptUser() {
         {
             type: 'password',
             name: 'password',
-            message: "Password",
+            message: "Password (>16 characters)",
             validate(val) {
-                if (val.length < 8) {
-                    return "Password too short. Must be at least 8 characters"
+                if (val.length < 16) {
+                    return "Password too short. Must be at least 16 characters"
                 }
                 return true
             }
@@ -135,7 +135,7 @@ async function promptSecurity() {
             type: 'select',
             name: 'adminAuth',
             initial: "Yes",
-            message: 'Do you want to setup user security?\n  DO NOT select No if you will expose Node-RED to the internet - or you will be hacked!',
+            message: 'Do you want to setup user security?\n  DO NOT select No if you will expose Node-RED to the internet - or you will be hacked!\n  If you select No we will restrict browser access to only the machine Node-RED is running on.\n  This can be changed by editing the uiHost entry in settings.js',
             choices: ['Yes', 'No'],
             result(value) {
                 return value === "Yes"
@@ -164,6 +164,7 @@ async function promptSecurity() {
     }
     else {
         responses.uiHost = 'uiHost: "127.0.0.1",'
+        console.log("\nuiHost set to 127.0.0.1 to restrict access to local machine ONLY.");
     }
     return responses;
 }