To prevent /var being sent to the server, I will add a second check for /var as a normal command which will report an error.
Same as in no-beta, in newest beta I'm seeing /var in editbox sending info to the server, just neither sending the 'var' string itself.
(typed in editbox)
/var %password foobar
/var -s %password foobar
Causes @debug window to show:
-> adams.freenode.net %PASSWORD foobar
<- :adams.freenode.net 421 maroon %PASSWORD :Unknown command
-> adams.freenode.net -S %password foobar
<- :adams.freenode.net 421 maroon -S :Unknown command