For #2 you can define it in the web.config
Look for the <membership /> section, inside that you'll see an <add /> section that defines the connectionStringName, applicationName, etc.
Add the following tags to that:
minRequiredPasswordLength="4" minRequiredNumericCharacters="0" minRequiredNonAlphanumericCharacters="0"
This would change it from the default behavior to a minimum length of 4 characters with no requirements for numeric or nonalpha characters.
Change that to suit your purposes, of course.