API error. :( The username and password get percent-encoded as part of the body, so could be an error in encoding applied on my end, or decoding applied on 10C's end.

//