Do not accept + in secure passwords either

Like /, it makes URLs not work :/

(cherry picked from commit 5654b733c4356db15f73f82975fafbb9701ef5c8)