4 ms·

Allowing + in an email/password field, but failing to properly encode/decode it, is even more infuriating.