Unlike ApiToken.from the value is '''not''' trimmed: leading and trailing whitespace can be significant in a password. Rejects an empty value and any value containing a control character, which cannot survive header encoding.
The returned ValidationError describes the failure on the "password" field and never echoes the rejected input.