I wonder if request validation disallows angle brackets in passwords too? That would be quite funny considering we don't store or render passwords.