We should still be able to allow hashtags in passwords. This can be done by escaping the url first before parsing it.