allow password with non xml friendly character