Wait, the users password is part of the URL? What happens if the password contains a forward slash or a question mark? Wouldn't that break the whole endpoint?
Original author here. Upon inspection, these passwords are clearly not chosen by the user and, as far as I can tell, consist only of numbers and uppercase letters.
More of an ugly authToken then.
RFC 1738 Uniform Resource Locators (URL) December 1994 section 2.2