I respectfully disagree about 1. Because of the autodetection, you can't be sure that the server you're connecting to is the right one. You have to double check

I respectfully disagree about 1. Because of the autodetection, you can't be sure that the server you're connecting to is the right one. You have to double check this before you send your password to a potential attacker.