This reverts commit 7dcad95d4f.
The output template is most definitly allowed to contain forbidden characters; otherwise -o /foo/bar/vid.mp4 wouldn't work.
It only supports verifying the password over https now.
Use it instead of manually setting the 'password' cookie because it allows to check if the password is correct.