The restrictions are:

1)  The user name must be unique and cannot be NULL.  
2)  The password can be up to 255 unicode characters.
3)  You must implement User-level security on the database, remove read
design permissions on this table for the users, and create a RWOP query that
users can use to authenticate.

Oh wait, hon ... since you have to implement security anyway to protect the
table from curious eyes, why not just use the CurrentUser function to
determine who the current user is?  If they opened the secure database, then
they must have used the correct password, so there's no need to store the
user name and password in a table, eh?