Is there any reason to have a whitelist of characters that can be the part of the password string?