sec_<phonemac>.xml file:

Code
<?xml version="1.0"?>
<MacProfile>
  <login_info id="2953" password ="34343"></login_info>
</MacProfile>

The phone then immediately requests /scm_profile/sec_user_2953.xml from the HTTP server. Filename is of course determined by the login_info text node in the previous file.

Reverse engineering the format of the sec_user_<userid>.xml file is proving difficult.