Do not accept / in secure passwords

Otherwise, this conflicts with URI that contain the passwords.