Creating a user in Sitefinity backend with a password that contains many special symbols prevents this user form being authenticated. Upon attempting to authenticate this user you get request validation exception:

A potentially dangerous Request.Form value was detected from the client (C006$ctl00$ctl00$password$ctl00$ctl00$textBox_write="Ai&#JfBFO#").

The request validation of passwords is due to asp.net request validation breaking changes: https://www.asp.net/whitepapers/aspnet4/breaking-changes#0.1__Toc256770147 refer to section Request Validation.

None at this time.

The workaround is to implement request validation per route or per request for the Sitefinity site, Sitefinity will not modify the behaviour inherited from asp.net 4.0.
I have attached a solution to the most common cases where such problem may occur:
1. Login to the backend
2. Register and login at the frontend of the site.

Refer to the attached file CustomLoginValidationWidgets.zip. It contains custom login widget, custom registration widget and custom request validator to be used to overcome the problem by handling the validation for requests of users with such passwords.

1. Login and registration widget add encoding and decoding of the password to avoid it passing trough request validation.
2. The decoding is done in Global.asax via custom TokenServiceHttpHandler which is also attached.
Register the handler in Global.asax like below:

protected void Application_Start(object sender, EventArgs e)
{
Bootstrapper.Initialized += Bootstrapper_Initialized;
}

void Bootstrapper_Initialized(object sender, Telerik.Sitefinity.Data.ExecutedEventArgs e)
{
if (e.CommandName == "RegisterRoutes")
{
CustomSecurityTokenServiceHttpHandler.Register();
}

3. Register the RegistrationFormCustom and LoginWidgetCustom as widgets in Sitefinity: http://docs.sitefinity.com/register-a-new-widget-in-sitefinity-toolbox and register the httphandler in Global.asax

4. Register the custom request validator in web.config in <httpRuntime> section under <system.web> (note therea are several <httpRuntime> elements in web.config use the one that is not inside of a <location> tag)

<system.web>
<httpRuntime maxRequestLength="102400" maxUrlLength="102400" maxQueryStringLength="10000" requestValidationType="SitefinityWebApp.CustomWidgets.MyRequestValidator, SitefinityWebApp" />

Further solutions are to disable the new feature of asp.net 4.0 by using the legacy request validation <httpRuntime requestValidationMode="2.0" /> or better by fallbacking to the legacy validation only for specific routes using web.config <location> tag. e.g.

<location path="Sitefinity/Authentication/SWT">
<system.web>
<httpRuntime .....