Let me preface what I'm posting with this: you are thinking that short weak passwords would be nice so that the user has a good user experience with their login. But consider the user experience if their account is compromised or the whole site is compromised - that experience is far, far worse than the minor annoyance of a more secure password.
In terms of your 3 options, I would say 1 is absolutely a terrible option, 3 is very bad. People don't have 6 character simple passwords as their favorites. Anyone who does have a 6 character password as their favorite is at very high level of risk already. Additionally, it's somewhat trivial to brute force a 6 character password.
Also against 1 and 3, if you do allow for weak passwords, users who are conscious of security may very well choose to not use your site because they feel you are not serious about security.
Remember that the purpose of a password is to keep the dishonest out. If all you cared about was letting the user identify themselves, you'd just have them type in their email address or user name.
All that said, number 2 is decently secure. Don't worry about people forgetting it - many people let their browser remember the password, and many people (unfortunately) reuse passwords on multiple sites. Almost any site that users interact with now days and entrust with any important information will enforce these kinds of stricter password rules. Users are used to it.
Irrespective of whether the CC can be accessed by the user, you will create a security risk for your site by allowing anyone in with a weak password. Your site may have security holes that allow a logged in user to access data that they should not have access to. You may think your site is secure, but then so did every huge company out there that's been hacked.
PS
If you don't want people to have to remember a password, consider alternative approaches such as login via link in email as described at https://stackoverflow.com/questions/4653903/instant-login-from-email-why-have-so-few-done-this. Or you might use some kind of one time access token that is sent to or generated by their phone.