I'm guessing, that they simulate an iCloud login and then store the cookie on their servers and then use that cookie to login in the future?

But thinking about it, it's a CalDAV server which normally uses email + password to authenticate..