One or 2 issues there maybe. Where do you get the error? In NR or in the browser?
I don't think it can be the & unless Node-RED is doing something odd with it, that code works fine when I test it in the browser. Using URL encoding might be preferred so your replacement with & should work (remember to include the trailing ; though, it wasn't in your example).
The other issue isn't related to your problem but of course, you shouldn't be including an id & password in the URL if you can help it since, especially without TLS, URL's may get cached. I realise that your example is internal to your network but it still isn't good practice. I certainly wouldn't do that over a public network.