Here I have a backward compatibility concern. While the RFC makes it clear that non-printables other than space are not acceptable in commands, I can imagine people using passwords with things like tab and backspace in them, and while that would violate the RFC, it would currentlywork, and this would break that.

What do you think?

Note that since this is the client side, this is not, IMO, a security issue, it's more of an RFC conformance issue.

Yeah, I agree. This is fine on main but I'm not sure I'd backport it, even as a bugfix.

For now we'll hold off on backporting this PR as they are potentially breaking some existing behavior.