By accident put my account password in the (plaintext) GET requests for real-time updates. Noticed it when I was network sniffing (see other post about rtupdate). Also noticed that sometimes these requests were successful and always were when switching to
www.wunderground.com.
I have not looked to see if this is documented, but it seems very wrong. Why have station keys then?