improve sp_password detection and fix possible read-over-run