Is there a plus sign in your generated password? If not, a space? Wondering about form encoding issues.

I'll look into reproducing this with a test account (been meaning to create one).

Also will see if I can switch login to send JSON rather than form data to avoid the whole mess.