* isa string should rewrap as unsafe in get_validated_value
* _is_unsafe shouldn't be concerned with underlying types
* Start with passwords as text, instead of bytes
* Remove unused imports
* Add changelog fragment
* Update changelog with CVE
(cherry picked from commit baeff74)
Co-authored-by: Matt Martz <matt@sivel.net>