Only mentioned in the MySQL authenticator section, although the limitation is likely in all authenticators.