Actually the security key was fine. We did generate a new one while on the call just to be safe. The ultimate fix was a bug in the code. The "&" was not being handled.
Do I still get billed for bugs?
By the way the gentleman that worked with me was great.