CommunityAuth Password Characters

We're running into an issue with CommunityAuth and passwords and I'm not quite sure where to look to configure to either block or allow...

If a user includes a '&' (ampersand) character in their password it's allowing the change to go ahead but then they can't login, so the & is being misinterpreted at some point.

Ideally I'd like to block specialchars and just allow alphanumeric.

Any pointers?

Thanks

Steve