accept - and _ for user passwords