passwords may now contain pretty much whatever you want