These changes move the PasswordPolicy field default-value initialization from a private constructor to the field declaration, and where appropriate, qualifies the field with "final".

The motivations are:

1. Easier to find default field values (e.g., use an IDE's "go to declaration" mechanism).

2. Mark any field with "final" that does not have a reasonable default value (i.e., those that depend on some constructor argument) to help ensure the object is properly initialized.