add '@' and '#' as allowed chars for passwords [#1309]