When are the password phrase controls enforced?