Obviously a problem for passwords with leading/trailing spaces.... Why are we trimming here? Seems like it should be a concern of the caller (i.e., sanitizing the input against password policies).