Whitespace, syntatic sugar, move the URLs to yahoo.h, and escape the token-fetching URL parameters. I'm appalled their server works if I pass https://login.yahoo.com/config/pwtoken_get?src=ymsgr&ts=&login=me&passwd=hunter2&chal=e^r-t*w%4+h&p^y-o|i|(p&l^z/a-j-l&x/r+h&q^u)/s/a&s|8&j/j^e*1+4|f