The links do not need to be encoded -- they are allowed to ask for your email address -- but they can't ask for much else. And definitely not a username/password.