Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know

Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't. By not allowing non-ascii characters in the first place you remove a whole class of support issues.