That's a bug, the regular expression in the contentModel.xml has been changed to be less strict and allow '&' and other chars. But the web-client has it's own regex - this is wrong and will be fixed for 2.1 final. Thanks for spotting it! http://issues.alfresco.com/browse/AWC-1326
Yes that is correct - it is now possible to do that, it should also have been possible in the web-client, but a step was missed, it will be fixed shortly.