I'm having the same problem you had with my controller running 8.0.2P1 and noticed in the config guide it says:
So according to the docs your '&' should have been ok. Anyway, I set a username/password that has no special characters whatsoever and I still get the same error. I checked a packet trace and it looks like login is actually OK and a few API call/responses are occurring. Login with another netapp, not invovled with virtualization and running 7.3.6 and it succeeds.