url params are not form data. there is no reason to send username/pwd as params. holy shit. i am dumb.