Fifty one I used to be asking myself this problem when earning an HTTP ask for from a native (not browser based) Application. I'm guessing this might interest cell App builders. Also, your passwords are exposed and possibly logged and this is another excuse to work with just one time https://ukpassportapplicationserv21085.bloggazza.com/36386224/uk-copyright-application-service-no-further-a-mystery