properly encode special characters in passwords