be less strict about username/password value checking

refs #165