Just to close this loop, because I like things closed. I wasn't able to reproduce this in the end. I'll keep trying, but seems like I must have mis-diagnosed the issue, I think.
Thanks for all the suggestions and help here. This kind of help and support is so wonderful and valuable.
Paul Mansueto Namuag <paulnamuag@gmail.com> writes: > Possibly the password might have non-ascii or something causing it to > unmatched but when stripped off, that non-ascii wasn't included.
Oh --- another variant of that theory, if there's any non-ASCII in the password, is that you're getting bit by an encoding conversion issue. That is, whatever the client is sending is in a different encoding from the way the password was stored.