In the past it's been a bad idea to define your bnc connections in the server list. I'm not positive on current behavior.

I'm not sure what /debug does without an argument, I usually log to a window: /debug @debug

I know that connecting to my server: /server znc.server.com +9000 memnoch/localhost: (I send my username and a blank password because authentication is done against my client certificate.)

Then reconnecting the password is sent as expected:
Code:
-> irc.server.com QUIT :
-> znc.server.com CAP LS
-> znc.server.com PASS memnoch/localhost:
-> znc.server.com NICK Memnoch
-> znc.server.com USER memnoch 0 * :Memnoch


Instead of using the "on connect" event I think you need to use the "on logon" event to send the pass.