Access Code allowed characters?

What are the allowed characters in an Access Code used to Protect an album? When I included a special character (&), it seemed to accept it and it locked the album, but the “login” screen would not accept the Code. It just returned to the login screen.

I have published my albums using Lightroom Publisher and I used Lightroom to set the Access Code.

Does anyone have an answer to my question (above)?

Until @Ben can take a look, you’re probably best off using letters and numbers only

Backlight is encoding any form values except for copy areas to prevent cross-site-scripting. & is therefore becoming &amp; and an access code like &pple becoming &amp;pple. I’ve put in a fix in our code that will come out in the next release. Till then, avoid using these characters in Access Codes: &, ", < and >.

Thank you!