Fixed: escape special HTML characters in password; reported by @zhoujy