diff --git a/radicale/tests/test_auth.py b/radicale/tests/test_auth.py
index 69110e73..2f6d36fb 100644
--- a/radicale/tests/test_auth.py
+++ b/radicale/tests/test_auth.py
@@ -94,6 +94,14 @@ class TestBaseAuthRequests(BaseTest):
     def test_htpasswd_plain(self) -> None:
         self._test_htpasswd("plain", "tmp:bepo")
 
+    def test_htpasswd_blacklist_plain(self) -> None:
+        self._test_htpasswd("plain", "tmp:be:po", (
+            ("tm" + chr(9) + "p", "be:po", True), ("tm" + chr(9) + "p", "bepo", False)), check=401)
+        self._test_htpasswd("plain", "tmp:be:po", (
+            ("tm'p", "be:po", True), ("tm'p", "bepo", False)), check=401)
+        self._test_htpasswd("plain", "tmp:be:po", (
+            ('tm"p', "be:po", True), ('tm"p', "bepo", False)), check=401)
+
     def test_htpasswd_plain_autodetect(self) -> None:
         self._test_htpasswd("autodetect", "tmp:bepo")
 
@@ -108,6 +116,39 @@ class TestBaseAuthRequests(BaseTest):
             check = 207
         self._test_htpasswd("plain", "😀:🔑", "unicode", check=check)
 
+    def test_htpasswd_strict_plain_unicode(self) -> None:
+        """user with unicode chars is not permitted"""
+        self.configure({"server": {"validate_user_value": "strict"}})
+        if not pathutils.path_supports_unicode(self.colpath):
+            check = 500
+        else:
+            check = 401
+        self._test_htpasswd("plain", "😀:🔑", "unicode", check=check)
+
+    def test_htpasswd_minimal_plain_unicode(self) -> None:
+        """user with unicode chars is permitted"""
+        self.configure({"server": {"validate_user_value": "minimal"}})
+        if not pathutils.path_supports_unicode(self.colpath):
+            check = 500
+        else:
+            check = 207
+        self._test_htpasswd("plain", "😀:🔑", "unicode", check=check)
+
+    def test_htpasswd_minimal_plain_special(self) -> None:
+        """user with special chars is not permitted"""
+        self.configure({"server": {"validate_user_value": "minimal"}})
+        check = 401
+        self._test_htpasswd("plain", "*?*:bepo", "ascii", check=check)
+
+    def test_htpasswd_unicode_plain_unicode(self) -> None:
+        """user with unicode symbols is not permitted"""
+        self.configure({"server": {"validate_user_value": "unicodeletter"}})
+        if not pathutils.path_supports_unicode(self.colpath):
+            check = 500
+        else:
+            check = 401
+        self._test_htpasswd("plain", "😀:🔑", "unicode", check=check)
+
     def test_htpasswd_md5(self) -> None:
         self._test_htpasswd("md5", "tmp:$apr1$BI7VKCZh$GKW4vq2hqDINMr8uv7lDY/")
 
@@ -301,7 +342,8 @@ class TestBaseAuthRequests(BaseTest):
             self._test_htpasswd("plain", "%s:bepo" % user, (
                 (user, "bepo", True), ("tmp", "bepo", False)), check=check)
 
-    def test_htpasswd_problem_user(self) -> None:
+    def test_htpasswd_problem_user_none(self) -> None:
+        self.configure({"server": {"validate_user_value": "none"}})
         for user in ("tm*p", "tm?p"):
             if not pathutils.path_supports_problematic_chars(self.colpath):
                 check = 500
@@ -310,6 +352,16 @@ class TestBaseAuthRequests(BaseTest):
             self._test_htpasswd("plain", "%s:bepo" % user, (
                 (user, "bepo", True), ("tmp", "bepo", False)), check=check)
 
+    def test_htpasswd_problem_user_minimal(self) -> None:
+        self.configure({"server": {"validate_user_value": "minimal"}})
+        for user in ("tm*p", "tm?p"):
+            if not pathutils.path_supports_problematic_chars(self.colpath):
+                check = 500
+            else:
+                check = 401
+            self._test_htpasswd("plain", "%s:bepo" % user, (
+                (user, "bepo", True), ("tmp", "bepo", False)), check=check)
+
     def test_htpasswd_whitespace_password(self) -> None:
         for password in (" bepo", "bepo ", " bepo "):
             self._test_htpasswd("plain", "tmp:%s" % password, (
diff --git a/radicale/tests/test_base.py b/radicale/tests/test_base.py
index b36497dd..77ef5242 100644
--- a/radicale/tests/test_base.py
+++ b/radicale/tests/test_base.py
@@ -623,6 +623,44 @@ permissions: RrWw""")
         self.get(path1, check=404)
         self.get(path2)
 
+    def test_move_unicode(self) -> None:
+        """Move a item."""
+        self.mkcalendar("/calendar.ics/")
+        event = get_file_content("event1.ics")
+        path1 = "/calendar.ics/event😀1.ics"
+        path2 = "/calendar.ics/event😁2.ics"
+        self.put(path1, event)
+        self.request("MOVE", path1, check=201,
+                     HTTP_DESTINATION="http://127.0.0.1/"+path2)
+        self.get(path1, check=404)
+        self.get(path2)
+
+    def test_move_strict_unicode_dst(self) -> None:
+        """Move a item."""
+        self.configure({"server": {"validate_path_value": "strict"}})
+        self.mkcalendar("/calendar.ics/")
+        event = get_file_content("event1.ics")
+        path1 = "/calendar.ics/event1.ics"
+        path2 = "/calendar.ics/event😁2.ics"
+        self.put(path1, event)
+        self.request("MOVE", path1, check=400,
+                     HTTP_DESTINATION="http://127.0.0.1/"+path2)
+        self.get(path1, check=200)
+        self.get(path2, check=400)
+
+    def test_move_strict_unicode_src(self) -> None:
+        """Move a item."""
+        self.configure({"server": {"validate_path_value": "strict"}})
+        self.mkcalendar("/calendar.ics/")
+        event = get_file_content("event1.ics")
+        path1 = "/calendar.ics/event😀1.ics"
+        path2 = "/calendar.ics/event2.ics"
+        self.put(path1, event, check=400)
+        self.request("MOVE", path1, check=400,
+                     HTTP_DESTINATION="http://127.0.0.1/"+path2)
+        self.get(path1, check=400)
+        self.get(path2, check=404)
+
     def test_move_between_collections(self) -> None:
         """Move a item."""
         self.mkcalendar("/calendar1.ics/")