Fix non-session and use hex password because of URL encoding could have a /