don't strip nasty chars in passwords