Bugfix: decode password fetched from request to handle special chars

correctly