This is a brand new application, right? Why is it built on '90s (or, worse, '70s) cryptography?

You need to publish the server-side source code for me to have any chance of making sense of this. I only see the client side of the connection in your source code, not the server response.