Changing the password of a user to password with an ampersand breaks login of that user

Issue looks like CMS7-2987, but this issue is about changing the password of an existing user.

Reproduction steps:

• as admin, change the password of editor to "t&st"
• logout
• login as editor / t&st
• unable to log in
• log in as admin
• change password of editor back to original password ("editor")
• logout
• log in as editor / editor
• login succesful