I have no idea how this is supposed to work, though. How can they guarantee that the agent does not see the password and username in a browser they fully control?!