An account is only for saved views: no profile, no tracking, and the map works signed out.
At least 10 characters. Passwords are stored as a scrypt hash; the session is an opaque token, not the password. No email verification or reset yet — that is the next step, not something this form pretends to have.