See msg253287.  Someone should check the RFC.  It is not obvious that just encoding using utf8 is correct; fundamentally passwords are binary data.  But the auth methods don't currently accept binary data.  UTF8 is a reasonable default these days, I think, but if we support more than ascii I think we need to support binary, with utf8 as the default encoding.