I agree with your assessment here, it looks as though you are missing this vendor value in your get request. On your confirm page look for the function call that makes this request:
Please post back with the call that you have on the page, the parameters that are supposed to be used here are:
These should correspond to vendor = signature, user = username, pwd = password
Check the signature value that is being used in this function call to see if it matches what you have for the vendor in the first request. Please post back with what you discover.