The WD10 draft says :
3.1.3.4 User Name
If the User Name Flag is set to 1, this is the next field in the payload. User Name is a UTF-8 encoded string and can be used by the server for authentication, and authorization.
3.1.3.5 Password
If the Password Flag is set to 1, this is the next field in the payload.,Password is a UTF-8 encoded string and can be used by the server for authentication of the client
This allows implementer s to display these fields on admin screens but prevents them from being from carrying binary tokens.
We don't need to change the wire format to encode this if the binary field is prefixed with a 2 byte length.