Allow attacker inputs not to conform to UTF-8

Some data come from attacker. And not all attackers know that passwords
should be in UTF8, so accept everything simply as raw data.