5.5.1 did the trick!
just to add some info, the password is displayed correctly in sessionOptions.Password when debugging, it's when looking at the winscp debug log you can see that the the password is modified and special characters are escaped.
I've been using the winscp .NET assembly for a while and after upgrading from winscp 5.1.7 to 5.5.0 I can't have "&" or "+" in ftp-passwords anymore. They are translated into escape codes (&=%26, +=%2B) and sent to the ftp-server for authentication.
Is this a new bug or configuration missmatch? Advice please!