Remove & as a forbidden character

On branch 2.6 as requested