Ryan De Kock wrote:

Is there a list of valid characters that can be in the username & password feild of the access-request and account-start packets?

They're supposed to be UTF-8. In practice, they can be pretty much anything.

for example, is a space (" ") valid in the username, #,&,^,etc. Where can I find this kind of info?

RFC 2865 Section 5.1 and 5.2 Alan DeKok.