Allow fancy characters in usernames and passwords, added '&' to list of restricted chars