The server checks that you are entitled to the service, but it's not just by the username and password (hence the "open" nature of those), it's by your phone number and (I think) your IMEI.
i.e. is this phone subscribed for web browsing? No? "You are not subscribed to a cellular data service", and so on.