Upon closer inspection of the HTTP response, I see that it complains about password complexity. The password above was just an example, but my real password also only had one dash, and it appears dashes do not count as special characters. Changing to a different special character solved the problem.
So this was a user error, and the topic can be closed. But perhaps the UI should be updated, in this case it looks like the frontend treats dashes as special characters, but the backend does not.