That's an odd use of the word "sensible" applied to "password".
Are you sure you don't mean "username" where you have "password"? A password
restricted to \w+ is surely much easier to hack. Maybe if that is indeed a password,
you need to rewrite the code that deals with passwords, rather than restricting
the users to such a guessable set.