Hi Alfred,

>   pop://<USER>:<PASSWORD>;auth=+APOP@<HOST>
> 
> is interpreted as having the user <USER>:<PASSWORD>.

Thanks for noticing.  Please, try the attached patch.

Regards,
Sergey