wow, thanks for that quick reply, and yes you’re absolutely right: it’s an encoding issue.
The authors of the server implementation (http://sabre.io/dav/authentication/) write
Avoid non-ascii characters for passwords. We've noticed that different clients
may use different encodings for passwords (windows may use CP-1252 and
others UTF-8), so each results in a different password string.
And indeed, firefox, thunderbird and chrome use utf-8 before md5’in the password. And that is, what the server expects, btw. Although this is no longer a real bug to me (due to the ‘known limitations’), for future use you may either parse the ‘Accept-Charset: utf-8,*;q=0.1\r\n’ that the server sends, or make a configuration option ‘treat username & password as utf-8’. How are people with non-western characters using your great app?