Do not accept + in secure passwords either

Like /, it makes URLs not work :/