MQTT authorization now required?

http://test.mosquitto.org/ seems to imply that port 1883 is still unencrypted, and doesn't need a certificate.

The not authorized is probably because you've got:

  username: "username",
  password: "password",

What happens if you just remove those?

But even for the encrypted comms, you can still use TLS with Espruino WiFi and/or the Pico.