My URLs normally look like this:

but occasionally one arrives like this:;bcsi-ac-3CA58FAD43257DE1=1E08471000000005HI6/ziFwyMTzliaD2x6OYpIvEvYyAAAABQAAAK5uLgCAcAAAAQAAAPOKAAA=

Some googling revealed that the ;bcsi-ac... stuff is probably some basic authentication information added by a not-too-clever proxy.  It surprised me to also learn that the semicolon is a valid query item separator (  If WebUtils.FieldStorage had known this then my code would have happily ignored this junk and my user would have been OK.

In my view nobody should go around adding parameters to other programs' URLs, so I consider this problem the fault of whatever added that junk.  I thought I'd mention it for interest, and in case it affects anybody else.