> With only a couple of minutes experimentation I discovered that the app works by concatenating the username and password5 and using it in a URL of the form:

yikes