Hi, I'm new to Salesforce. I'm writing a headless Connected App that connects with username and password via REST. We have 3 environments: my own Developer Edition, a dev sandbox, and production.

I've noticed a few things that seem odd:
    - I can "log in" to login.salesforce.com (I'm assuming this in the production endpoint) with Developer Edition credentials. But the returned instance url points at dev edition
    - I can't log into test.salesforce.com with Developer Edition credentials. This seems inconsistent with the previous point.
    - I can log into Developer Edition using the client key and secret of a connected app that exists in the dev sandbox.If I modify the key or secret, or even delete the app from dev, I can no longer successfully authenticate against the Developer Edition instance.

I guess there are 2 questions:

1) Does SF use the security token inside my password to identify which organisation I'm trying to log into?
2) My Developer Edition instance was created by me in isolation to my company's instance. How could it possibly be using connected app details from a dev instance it can have no knowledge of, unless it's basing security concerns around my email address? 

The first of these seems odd. the second seems like a bug. But maybe I'm missing something?

Thanks,

Andy