Use same user/password restrictions as in the webapp. Closes #5894.