sorry so long.
if you still get on
(i find hellbound is much better but i started here)

you'll notice in the <form> tag that the password file is not even hidden! so simply slap the file onto the end of your url and it gives it up =)

for basic 3 check the source code for a hidden field, theres your awnser