Do not accept + in secure passwords either

Like /, it makes URLs not work :/
Merge pull request #994 from vuntz/plus-not-in-secure

Do not accept + in secure passwords either