bug fix with case-insensitive wildcard sets

using %[chars] and %i[chars] where chars was the same would result in
both wildcards being expanded to the same set (one would be wrong);
also minor memory improvement in password_generator() by moving the
duplicate checking to after the positional anchor checking;
other minor updates