That same path /app/{id}/{any*}", came up in a different thread last week, where while troubleshooting that issue we possibly hit this one too.
Note OP in that other thread deemed a : character in his password as the core issue, and there were other unrelated complications, but he was also using a proxy (apache in his case).