I posted to CodeHS support today to clear up this problem. The statement is vague, and the grader is not well considered.
The statement should say passwords may only consist of letters and digits.
The grader should test values other than those in the sample driver. I had kids check for ':' and ' ' in their programs, based on the smiley example, and the grader passed them.
I also made the general request that the grader more fully exercise the problems as stated, and that it not use the examples as the test cases.