Calling sanitize() on the password field was breaking passwords with special characters