lastminute.com, which handles it thusly: you can book your holiday and what not, but you can't access your order afterwards. The 'I've forgotten my password' form doesn't help as it converts the '+' to a space before telling you that you didn't enter an email address... and using %2b instead of '+' makes it look for that literally, rather than doing entity decoding to get the correct version. Sigh. What year is it again?