I was getting this in appserver/glassfish/domains/domain1/logs/server.log until I removed the $ and semicolon from my password.
[#|2016-02-26T12:39:36.481-0500|WARNING|glassfish3.1.2|javax.enterprise.system.container.web.com.sun.enterprise.web._vs.server|_ThreadID=146;_ThreadName=Thread-23;|StandardWrapperValve[CreateRootUser]: PWC1406: Servlet.service() for servlet CreateRootUser threw exception javax.servlet.ServletException: Bad Input in HttpRequest at com.singularity.ee.controller.servlet.XssInputValidator.sanityCheckIncomingData(XssInputValidator.java:177) at com.singularity.ee.controller.servlet.XssInputValidator.doCreateRootUserParameterValidation(XssInputValidator.java:143) at com.singularity.ee.controller.servlet.CreateUserFilter.doFilter(CreateUserFilter.java:50) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:256)